WordPress Plugin Vulnerabilities

CloudSecure WP Security < 1.4.8 - Two-Factor Authentication Bypass

Description

The plugin is vulnerable to Two-Factor Authentication Bypass, making it possible for unauthenticated attackers to bypass two-factor authentication.

Affects Plugins

Plugin icon
cloudsecure-wp-security
Fixed in 1.4.8

References

CVE
CVE-2026-42411
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/af01cba6-40df-4eb9-beec-4716909a671b

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
0xzenko
Verified
No
WPVDB ID
92a59c5e-ae8f-43e3-989a-edbaaf1e6716

Timeline

Publicly Published
2026-05-28 (about 1 month ago)
Added
2026-06-02 (about 1 month ago)
Last Updated
2026-06-02 (about 1 month ago)

Other

Published
Title
Published
2025-08-01
Title
Brave Conversion Engine (PRO) < 0.8.0 - Authentication Bypass
Published
2022-10-31
Title
WP User Frontend < 3.5.29 - Obscure Registration as Admin
Published
2026-05-04
Title
MoreConvert Pro < 1.9.15 - Authentication Bypass via Waitlist Guest Verification Token Reuse
Published
2024-08-16
Title
Login As Users < 1.4.3 - Authentication Bypass
Published
2022-09-05
Title
OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass