{"metadata": {"vulnerability": "CVE-2026-104732", "count": 17, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-02T11:49:12.681Z", "date_only": false, "value": "2026-10-02T11:49:12.681Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104732", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-02T13:19:16Z", "date_only": false, "value": "2026-10-02T13:19:16.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104732", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-09T15:13:42Z", "date_only": false, "value": "2026-10-09T15:13:42.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104732", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-10T03:26:45.330Z", "date_only": false, "value": "2026-10-10T03:26:45.330Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104732", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-10T03:26:45.330Z", "date_only": false, "value": "2026-10-10T03:26:45.330Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104732", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-10T03:45:55.900Z", "date_only": false, "value": "2026-10-10T03:45:55.900038Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117414556811815860", "record": "CVE-2026-104732", "field": "creation_timestamp", "uuid": "49904225-132e-492a-ab75-7601ff4bd70c", "content": "CVE-2026-104732 Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()` performs no server-side check \u2014 via transient, session marker, or equivalent \u2014 that a requester completed step-1 password authentication before processing a step-2 TOTP submission for the POSTed `user_id`; compounding this, an error branch in the function unconditionally mints a fresh `advaipbl-2fa-interim-{user_id}` nonce and delivers it in a `Location` header to any unauthenticated caller, after which `display_2fa_login_form_step_2()` renders a valid `advaipbl-2fa-verify-{user_id}` nonce in HTML \u2014 both nonces computed against a fixed `uid=0` empty-session context and therefore fully reusable by the attacker across subsequent requests. This makes it possible for unauthenticated attackers to bypass authentication entirely for any 2FA-enabled account, including administrators, by brute-forcing an unthrottled 6-digit TOTP code (no attempt counter, no account lockout, and no `wp_login_failed` firing) and receiving a fully authenticated session cookie via `wp_set_auth_cookie` without ever supplying the account password, resulting in complete site takeover. Exploitation requires only a known `user_id` for an account that has the plugin's 2FA feature enabled.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104732https://www.wordfence.com/threat-intel/vulnerabilities/id/d080845b-6814-4b10-a3ab-1f5aa1d09132?source=cvehttps://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L6875https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L6912https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L7022https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-2fa-manager.php#L71https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L519https://plugins.trac.wordpress.org/changeset/3725139/advanced-ip-blocker/trunk/includes/class-advaipbl-main.php#wordpress #inilerm #AdvancedIPBlocker#CVE_2026_104732#bot", "url": "https://infosec.exchange/users/cve/statuses/117414556811815860"}, {"timestamp": "2026-10-10T04:18:08Z", "date_only": false, "value": "2026-10-10T04:18:08Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-PW6H-RJH8-7GRW", "record": "GHSA-PW6H-RJH8-7GRW", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-10T04:18:08.493Z", "date_only": false, "value": "2026-10-10T04:18:08.493", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104732", "record": "FKIE_CVE-2026-104732", "field": "published"}, {"timestamp": "2026-10-10T06:00:06.403Z", "date_only": false, "value": "2026-10-10T06:00:06.403099Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxisqmhaom2h", "record": "CVE-2026-104732", "field": "creation_timestamp", "uuid": "7d79addd-61e3-4a3b-baa8-e3f7d9a54f79", "content": "CVE-2026-104732\nThe Advanced IP Blocker add\u2011on for WordPress lets anyone who knows a user\u2019s ID skip the password step and log in by guessing a six\u2011digit code. This can give full control of the site, even for admin accounts.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxisqmhaom2h"}, {"timestamp": "2026-10-10T06:07:18.020Z", "date_only": false, "value": "2026-10-10T06:07:18.020838Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxit5idfec2n", "record": "CVE-2026-104732", "field": "creation_timestamp", "uuid": "43c77ac4-d203-426a-afdc-a25b198727a3", "content": "\ud83d\udea8 CVE-2026-104732 \u2014 CVSS 9.8 CRITICAL\n\nThe Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-104732\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxit5idfec2n"}, {"timestamp": "2026-10-10T06:30:56Z", "date_only": false, "value": "2026-10-10T06:30:56Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PW6H-RJH8-7GRW", "record": "GHSA-PW6H-RJH8-7GRW", "field": "published"}, {"timestamp": "2026-10-10T06:30:56Z", "date_only": false, "value": "2026-10-10T06:30:56Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-PW6H-RJH8-7GRW", "record": "GHSA-PW6H-RJH8-7GRW", "field": "modified"}, {"timestamp": "2026-10-11T16:43:48.337Z", "date_only": false, "value": "2026-10-11T16:43:48.337311Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104732", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-11T16:43:48.337Z", "date_only": false, "value": "2026-10-11T16:43:48.337311Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104732", "record": "FKIE_CVE-2026-104732", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-11T16:55:20.060Z", "date_only": false, "value": "2026-10-11T16:55:20.060Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104732", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-11T16:55:20.060Z", "date_only": false, "value": "2026-10-11T16:55:20.060Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104732", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T13:30:21.620Z", "date_only": false, "value": "2026-10-13T13:30:21.620", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104732", "record": "FKIE_CVE-2026-104732", "field": "lastModified"}]}