Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-111739

Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Two Factor Authentication

Default version status: unaffected

  • 0 to < 1.17.0affected

Unknown All-In-One Security (AIOS)

Default version status: unaffected

  • 0 to < 5.5.0affected

References