Key points
- CVE-2026-104732 is rated CVSS 9.8 Critical by the National Vulnerability Database.
- The vulnerability affects Advanced IP Blocker versions up to and including 8.13.13.
- Attackers can brute-force 6-digit TOTP codes due to a lack of server-side checks.
A critical authentication bypass vulnerability exists in the Advanced IP Blocker plugin for WordPress, enabling unauthenticated attackers to take over administrator accounts, according to the National Vulnerability Database. The flaw, identified as CVE-2026-104732, carries a CVSS score of 9.8, indicating a severe risk to website security and data integrity.
The vulnerability allows attackers to bypass two-factor authentication entirely by brute-forcing 6-digit TOTP codes without triggering account lockouts or failed login notifications. This occurs because the `handle_login_action()` function fails to verify that a user completed the initial password authentication step before processing the second-factor submission, creating a direct path to unauthorized access.
Technical Details of the Exploit
The issue stems from missing server-side checks for session markers or transients during the login process. An error branch in the function generates valid nonces for unauthenticated callers, which are then rendered in HTML for the second verification step. These nonces are computed against an empty-session context, making them fully reusable by attackers across multiple requests without detection.
Attackers exploit this by submitting brute-forced TOTP codes for a known user ID. Because there is no attempt counter or `wp_login_failed` firing, the system issues a fully authenticated session cookie via `wp_set_auth_cookie`. This grants the attacker complete site takeover without ever supplying the actual account password, effectively neutralizing the security benefits of two-factor authentication.
Who Is Affected
All versions of the Advanced IP Blocker plugin up to and including version 8.13.13 are affected by this vulnerability, according to the NVD record. Any WordPress site using this plugin with two-factor authentication enabled for user accounts is at risk. Administrators and other privileged users are particularly vulnerable, as exploitation requires only a known `user_id` for an account with 2FA enabled through the plugin.
Site owners should verify their plugin version immediately. If the installed version is 8.13.13 or lower, the site is susceptible to exploitation. The weakness is classified under CWE-287, which relates to improper verification of intent or action completion, highlighting a fundamental flaw in the plugin's authentication logic.
Next steps
Security teams should audit their WordPress installations for the Advanced IP Blocker plugin. Check the installed version against the affected range. If the plugin is present and vulnerable, consider disabling it or removing it until a secure update is available. Monitor server logs for unusual login patterns or repeated 2FA submission attempts that may indicate exploitation.
Background: Account lockout policies
Configure lockout thresholds high enough to block automated dictionary attacks but low enough to prevent accidental user lockouts. Implement exponential backoff to reduce administrative overhead and monitor for lockout spikes that indicate active credential stuffing attempts.
Read the full guide: Account Lockout Policies: Preventing Denial of Service Attacks
What to do and how to stay safe: WordPress
- Inventory all WordPress sites to identify installations of the Advanced IP Blocker plugin.
- Check the plugin version to see if it is 8.13.13 or older.
- Disable the plugin immediately if it is vulnerable, as no patch has been confirmed in the source material.
- Monitor authentication logs for brute-force activity on 2FA endpoints.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-104732?
The National Vulnerability Database rates CVE-2026-104732 as CVSS 9.8 Critical.
Which versions of Advanced IP Blocker are affected?
All versions up to and including 8.13.13 are vulnerable to this authentication bypass.
Do attackers need a password to exploit this flaw?
No, attackers can bypass authentication entirely by brute-forcing TOTP codes without supplying a password.
