The plugin generates authentication nonces (advaipbl-2fa-interim-{user_id} and advaipbl-2fa-verify-{user_id}) based on a fixed, empty-session context, making them fully reusable by an attacker. Furthermore, the 2FA verification endpoint lacks rate limiting, account lockout mechanisms, and does not fire standard wp_login_failed hooks. An unauthenticated attacker knowing a valid user ID can leverage these flaws to brute-force a 6-digit TOTP code and obtain a valid authenticated session cookie via wp_set_auth_cookie. This flaw allows for full site takeover, including administrator accounts, without ever requiring the account password.

Impact

Successful exploitation results in full unauthorized access to the WordPress environment as the targeted user. If an administrator account is targeted, the attacker gains complete control over the site, allowing for the execution of arbitrary code, data exfiltration, and persistence. Given the lack of rate limiting and logging on the 2FA verification process, attacks may remain undetected until the compromise is already complete.

Recommendation

• Update the Advanced IP Blocker plugin to the latest version immediately once a patch is released to mitigate CVE-2026-104732.
• Disable the 2FA feature of the Advanced IP Blocker plugin if immediate updating is not possible, and rely on standard WordPress authentication or alternative, patched MFA providers.
• Review web server access logs for repeated POST requests to the plugin's login endpoint targeting specific user IDs.
• Monitor for unauthorized administrative sessions or modifications to user account privileges.