{"vulnerability": "CVE-2026-104732", "sightings": [{"uuid": "49904225-132e-492a-ab75-7601ff4bd70c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104732", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117414556811815860", "content": "CVE-2026-104732 Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()` performs no server-side check \u2014 via transient, session marker, or equivalent \u2014 that a requester completed step-1 password authentication before processing a step-2 TOTP submission for the POSTed `user_id`; compounding this, an error branch in the function unconditionally mints a fresh `advaipbl-2fa-interim-{user_id}` nonce and delivers it in a `Location` header to any unauthenticated caller, after which `display_2fa_login_form_step_2()` renders a valid `advaipbl-2fa-verify-{user_id}` nonce in HTML \u2014 both nonces computed against a fixed `uid=0` empty-session context and therefore fully reusable by the attacker across subsequent requests. This makes it possible for unauthenticated attackers to bypass authentication entirely for any 2FA-enabled account, including administrators, by brute-forcing an unthrottled 6-digit TOTP code (no attempt counter, no account lockout, and no `wp_login_failed` firing) and receiving a fully authenticated session cookie via `wp_set_auth_cookie` without ever supplying the account password, resulting in complete site takeover. Exploitation requires only a known `user_id` for an account that has the plugin's 2FA feature enabled.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104732https://www.wordfence.com/threat-intel/vulnerabilities/id/d080845b-6814-4b10-a3ab-1f5aa1d09132?source=cvehttps://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L6875https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L6912https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L7022https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-2fa-manager.php#L71https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L519https://plugins.trac.wordpress.org/changeset/3725139/advanced-ip-blocker/trunk/includes/class-advaipbl-main.php#wordpress #inilerm #AdvancedIPBlocker#CVE_2026_104732#bot", "creation_timestamp": "2026-10-10T03:45:55.900038Z"}, {"uuid": "43c77ac4-d203-426a-afdc-a25b198727a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104732", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxit5idfec2n", "content": "\ud83d\udea8 CVE-2026-104732 \u2014 CVSS 9.8 CRITICAL\n\nThe Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-104732\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-10T06:07:18.020838Z"}, {"uuid": "7d79addd-61e3-4a3b-baa8-e3f7d9a54f79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104732", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxisqmhaom2h", "content": "CVE-2026-104732\nThe Advanced IP Blocker add\u2011on for WordPress lets anyone who knows a user\u2019s ID skip the password step and log in by guessing a six\u2011digit code. This can give full control of the site, even for admin accounts.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-10T06:00:06.403099Z"}]}