The Vigilant WordPress Plugin (< 2.11.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/the-vigilant-wordpress-plugin--2.11.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 17:49:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgThe Vigilant WordPress plugin: Authentication bypass via 2FA enforcement failure (CVE-2026-123091)https://feed.craftedsignal.io/briefs/2026-11-vigilant-wp-auth-bypass/Mon, 09 Nov 2026 17:49:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-vigilant-wp-auth-bypass/The Vigilant WordPress plugin before version 2.11.0 fails to enforce two-factor authentication on non-default login forms, allowing credentialed attackers to bypass 2FA.The Vigilant WordPress plugin for WordPress contains an authentication bypass vulnerability. Versions prior to 2.11.0 fail to enforce the configured two-factor authentication (2FA) mechanism when users authenticate via non-default WordPress login forms. An attacker in possession of a valid username and password can bypass the 2FA requirement to gain unauthorized access to the application.

Impact

Successful exploitation allows an attacker to bypass multi-factor authentication, significantly increasing the risk of account takeover for both administrative and standard user accounts.

Recommendation

  • Update "The Vigilant" WordPress plugin to version 2.11.0 or later immediately to enforce 2FA consistency across all login entry points.
  • Audit WordPress login logs for anomalous authentication events originating from non-standard login endpoints.
]]>highadvisory