Key points
- CVE-2026-104732 affects Advanced IP Blocker versions up to 8.13.13
- Attackers can brute-force 6-digit TOTP codes without triggering lockouts
- The flaw grants full site takeover without requiring user passwords
The Advanced IP Blocker plugin for WordPress contains a critical authentication bypass vulnerability that allows unauthenticated attackers to take complete control of affected sites. According to the National Vulnerability Database, the issue exists in all plugin versions up to and including 8.13.13. The flaw enables attackers to bypass two-factor authentication entirely by exploiting a lack of server-side validation during the login process.
In plain English
The vulnerability stems from how the plugin handles login requests. The function `handle_login_action()` fails to verify that a user completed the initial password step before processing the second-factor time-based one-time password submission. This allows an attacker to skip the password requirement altogether. The system then accepts TOTP codes for any known user ID without confirming the requester is the legitimate account owner.
Attackers can exploit this by brute-forcing the six-digit TOTP codes. The plugin does not implement attempt counters, account lockouts, or failure logging via `wp_login_failed`. This lack of throttling makes it easy to guess the correct code. Once the correct code is submitted, the system issues a fully authenticated session cookie, granting the attacker immediate access to the account.
The background
The flaw is rated as critical with a CVSS score of 9.8 by the NVD. It is classified under CWE-287, which relates to improper authorization. The issue is compounded by error handling that generates reusable nonces. Specifically, the function mints a fresh `advaipbl-2fa-interim-{user_id}` nonce and delivers it in a Location header to any caller, even unauthenticated ones.
These nonces are computed against a fixed empty-session context, making them fully reusable across requests. The subsequent function `display_2fa_login_form_step_2()` renders a valid verification nonce in HTML. This design allows attackers to maintain a valid state for the brute-force attack without needing to re-authenticate or provide valid session markers.
What changes now
Exploitation requires only a known user ID for an account that has the plugin's two-factor feature enabled. This includes administrator accounts. Once an attacker secures the session cookie via `wp_set_auth_cookie`, they have complete site takeover capabilities. No password is required for this takeover. The vulnerability affects all versions of the plugin up to 8.13.13.
No confirmed fix or patch has been released for this vulnerability yet. Site administrators should monitor vendor communications for updates. The severity of the issue is critical due to the ease of exploitation and the high impact of full site compromise.
Background: Authentication bypass vulnerabilities
Enforce server-side session validation for every request. Use short-lived tokens with strict scope. Implement multi-factor authentication to block credential theft. Remove client-side logic that makes access decisions. Audit your code for logic flaws that skip verification steps.
Read the full guide: Stop Authentication Bypass Vulnerabilities with Priority Controls
What to do and how to stay safe: Advanced IP Blocker
- Audit installed WordPress plugins to identify if Advanced IP Blocker versions up to 8.13.13 are present
- Monitor server logs for unusual login patterns or repeated failed TOTP submissions from unknown sources
- Restrict access to login pages using IP whitelisting or web application firewalls to reduce exposure
- Disable the plugin temporarily if no update is available and critical administrative access is required
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-104732?
The National Vulnerability Database rates the severity as critical with a CVSS score of 9.8.
Which versions of Advanced IP Blocker are affected?
All versions up to and including 8.13.13 are vulnerable to this authentication bypass flaw.
Do attackers need a password to exploit this vulnerability?
No, attackers can bypass authentication entirely without supplying the account password.
