Two-Factor Authentication Bypass in Vigilant WordPress Plugin by Vigilant
CVE-2026-123091
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-123091?
The Vigilant WordPress plugin prior to version 2.11.0 contains a flaw that permits the circumvention of its two-factor authentication on non-default WordPress login forms. This allows attackers with knowledge of a valid user's password to authenticate as that user without completing the second authentication factor, potentially compromising sensitive accounts and data.
Affected Version(s)
Vigilant 0 < 2.11.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.