WordPress Plugin Vulnerabilities

asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation

Description

The plugin does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.

Proof of Concept

Affects Plugins

Plugin icon
asvereinbase
Fixed in 1.1.8

References

CVE
CVE-2026-110956

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
9.8 (critical)

Miscellaneous

Verified
Yes
WPVDB ID
95501052-9f20-4391-9171-184cd2e4a445

Timeline

Publicly Published
2026-10-22 (about 2 days ago)
Added
2026-10-22 (about 1 day ago)
Last Updated
2026-10-22 (about 1 day ago)

Other

Published
Title
Published
2026-08-03
Title
Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter
Published
2014-11-01
Title
WP eCommerce <= 3.8.14.3 - Authorisation Bypass
Published
2023-11-06
Title
Simple Social Buttons < 5.1.1 - Unauthenticated Password Protected Post Access
Published
2026-07-20
Title
Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment
Published
2026-09-04
Title
MStore API < 4.21.1 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery