CVE-2026-110956EUVD-2026-109225GHSA-3838-5P3Q-5CGW
asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 1.1.8
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
The asVereinbase WordPress plugin, used to add association management and two-factor authentication features to WordPress sites, is affected. An unauthenticated attacker can bypass the login and two-factor checks to sign in as any user, including site administrators, and take full control of the affected website.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.
Affected versions
- Unknown asVereinbase
fixed in 1.1.8