Two-Factor Authentication Vulnerability in WordPress Plugins
CVE-2026-111739
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 29 October 2026
Badges
What is CVE-2026-111739?
A vulnerability exists in the Two Factor Authentication and All-In-One Security plugins for WordPress, where the mechanism for verifying two-factor codes does not properly associate the authenticated account with the verified code. This allows an attacker who knows the victim's password to potentially bypass the second factor check if they possess their own two-factor-enabled account. This situation enables the attacker to gain unauthorized access to the victim's session, compromising user security and potentially exposing sensitive information.
Affected Version(s)
All-In-One Security (AIOS) 0 < 5.5.0
Two Factor Authentication 0 < 1.17.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.