WordPress: Two Factor Authentication and AIOS MFA bypass (CVE-2026-111739)

The Two Factor Authentication plugin (prior to 1.17.0) and the All-In-One Security (AIOS) plugin (prior to 5.5.0) for WordPress contain an authentication flaw. The plugins fail to bind the two-factor authentication (2FA) verification process to the specific user account undergoing authentication. An attacker possessing both a victim's password and a separate, attacker-controlled 2FA-enabled account can satisfy the victim's MFA challenge by submitting their own 2FA token, resulting in the hijacking of the victim's session.

Impact

Successful exploitation grants an attacker unauthorized access to a victim's account, allowing for potential session hijacking and takeover of administrative or user accounts.

Recommendation

• Update the "Two Factor Authentication" plugin to version 1.17.0 or later.
• Update the "All-In-One Security (AIOS)" plugin to version 5.5.0 or later.
• Review WordPress authentication logs for concurrent or unusual login patterns where a single 2FA device or session identifier appears associated with multiple disparate user account authentication attempts.