Two Factor Authentication (< 1.17.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/two-factor-authentication--1.17.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 13:18:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWordPress: Two Factor Authentication and AIOS MFA bypass (CVE-2026-111739)https://feed.craftedsignal.io/briefs/2026-10-wordpress-2fa-bypass/Thu, 29 Oct 2026 13:18:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wordpress-2fa-bypass/A session hijacking vulnerability in Two Factor Authentication and All-In-One Security (AIOS) WordPress plugins allows attackers to bypass MFA by providing their own valid 2FA code during a victim's login process.The Two Factor Authentication plugin (prior to 1.17.0) and the All-In-One Security (AIOS) plugin (prior to 5.5.0) for WordPress contain an authentication flaw. The plugins fail to bind the two-factor authentication (2FA) verification process to the specific user account undergoing authentication. An attacker possessing both a victim's password and a separate, attacker-controlled 2FA-enabled account can satisfy the victim's MFA challenge by submitting their own 2FA token, resulting in the hijacking of the victim's session.

Impact

Successful exploitation grants an attacker unauthorized access to a victim's account, allowing for potential session hijacking and takeover of administrative or user accounts.

Recommendation

  • Update the "Two Factor Authentication" plugin to version 1.17.0 or later.
  • Update the "All-In-One Security (AIOS)" plugin to version 5.5.0 or later.
  • Review WordPress authentication logs for concurrent or unusual login patterns where a single 2FA device or session identifier appears associated with multiple disparate user account authentication attempts.
]]>highadvisoryweb-applicationauthentication-bypasswordpress