{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/two-factor-authentication--1.17.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:two_factor_authentication_project:two_factor_authentication:*:*:*:*:*:wordpress:*:*","cpe:2.3:a:all_in_one_security_and_firewall_project:all_in_one_security_and_firewall:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-111739"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Two Factor Authentication (\u003c 1.17.0)","All-In-One Security (AIOS) (\u003c 5.5.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","authentication-bypass","wordpress"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Two Factor Authentication plugin (prior to 1.17.0) and the All-In-One Security (AIOS) plugin (prior to 5.5.0) for WordPress contain an authentication flaw. The plugins fail to bind the two-factor authentication (2FA) verification process to the specific user account undergoing authentication. An attacker possessing both a victim's password and a separate, attacker-controlled 2FA-enabled account can satisfy the victim's MFA challenge by submitting their own 2FA token, resulting in the hijacking of the victim's session.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an attacker unauthorized access to a victim's account, allowing for potential session hijacking and takeover of administrative or user accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u0026quot;Two Factor Authentication\u0026quot; plugin to version 1.17.0 or later.\u003c/li\u003e\n\u003cli\u003eUpdate the \u0026quot;All-In-One Security (AIOS)\u0026quot; plugin to version 5.5.0 or later.\u003c/li\u003e\n\u003cli\u003eReview WordPress authentication logs for concurrent or unusual login patterns where a single 2FA device or session identifier appears associated with multiple disparate user account authentication attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T13:18:54Z","date_published":"2026-10-29T13:18:54Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wordpress-2fa-bypass/","summary":"A session hijacking vulnerability in Two Factor Authentication and All-In-One Security (AIOS) WordPress plugins allows attackers to bypass MFA by providing their own valid 2FA code during a victim's login process.","title":"WordPress: Two Factor Authentication and AIOS MFA bypass (CVE-2026-111739)","url":"https://feed.craftedsignal.io/briefs/2026-10-wordpress-2fa-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Two Factor Authentication (\u003c 1.17.0)","version":"https://jsonfeed.org/version/1.1"}