WordPress Plugin Vulnerabilities

Auth Armor <= 1.0.3 - Unauthenticated Account Takeover

Description

The plugin does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account.

Proof of Concept

Affects Plugins

Plugin icon
auth-armor-passwordless-login
No known fix

References

CVE
CVE-2026-110960

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
84878a65-29f3-4cb9-96dd-b3f35baa21f0

Timeline

Publicly Published
2026-11-13 (about 2 days ago)
Added
2026-11-13 (about 1 day ago)
Last Updated
2026-11-14 (about 7 hours ago)

Other

Published
Title
Published
2026-01-15
Title
Workreap Core <= 3.4.0 - Authentication Bypass
Published
2026-08-03
Title
Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling
Published
2025-08-01
Title
Brave Conversion Engine (PRO) < 0.8.0 - Authentication Bypass
Published
2026-08-28
Title
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.9 - Authentication Bypass
Published
2025-07-03
Title
WP Compress < 6.30.31 - Unauthenticated Broken Authentication