The Vigilant WordPress plugin: Authentication bypass via 2FA enforcement failure (CVE-2026-123091)

The Vigilant WordPress plugin for WordPress contains an authentication bypass vulnerability. Versions prior to 2.11.0 fail to enforce the configured two-factor authentication (2FA) mechanism when users authenticate via non-default WordPress login forms. An attacker in possession of a valid username and password can bypass the 2FA requirement to gain unauthorized access to the application.

Impact

Successful exploitation allows an attacker to bypass multi-factor authentication, significantly increasing the risk of account takeover for both administrative and standard user accounts.

Recommendation

• Update "The Vigilant" WordPress plugin to version 2.11.0 or later immediately to enforce 2FA consistency across all login entry points.
• Audit WordPress login logs for anomalous authentication events originating from non-standard login endpoints.