WordPress Plugin Vulnerabilities

Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code

Description

The plugin does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.

Proof of Concept

Affects Plugins

Plugin icon
security-malware-firewall
Fixed in 2.191

References

CVE
CVE-2026-114443

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Karthik
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
8f4a0675-82f0-4bbc-a46b-b88fc3863219

Timeline

Publicly Published
2026-10-28 (about 2 days ago)
Added
2026-10-28 (about 1 day ago)
Last Updated
2026-10-28 (about 1 day ago)

Other

Published
Title
Published
2026-08-14
Title
User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters
Published
2026-08-05
Title
Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header
Published
2026-08-29
Title
SAML Single Sign On < 5.4.7 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning
Published
2025-03-06
Title
WPCOM Member < 1.7.6 - Authentication Bypass via 'user_phone'
Published
2026-10-23
Title
WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret