Executive Summary
A critical vulnerability (CVE-2026-110956) with a CVSS score of 9.8 was discovered in the asVereinbase WordPress plugin. This vulnerability allows unauthenticated attackers to log in as any user, including administrators, without requiring a valid password or second factor. The affected plugin versions are before 1.1.8.
Technical Analysis
The vulnerability class is an authentication bypass issue (CWE-287). The attack vector is network-based (AV:N), with low attack complexity (AC:L) and no privileges required (PR:N). The vulnerability is triggered when an attacker attempts to authenticate with an empty stored value, which is treated as a match. The root cause is the plugin's improper authentication logic.
How It Gets Exploited
An unauthenticated remote attacker can exploit this vulnerability by sending a crafted authentication request to the WordPress plugin. Specifically, the attacker would:
- Send a login request to the WordPress site with an empty stored value for the user credentials.
- The plugin, failing to properly validate the credentials, would treat the empty value as a match.
- The attacker would then be authenticated as the targeted user, potentially gaining administrative access.
Impact Assessment
The asVereinbase WordPress plugin versions before 1.1.8 are affected. An attacker can achieve unauthorized access to the WordPress site, potentially leading to confidentiality, integrity, and availability impacts (C:H/I:H/A:H). The CVSS score of 9.8 indicates a critical severity level.
Recommended Actions
To mitigate this vulnerability, update the asVereinbase WordPress plugin to version 1.1.8 or later immediately. Additionally, monitor your WordPress site for suspicious login attempts and consider implementing additional security measures, such as two-factor authentication and login attempt limiting.
Sources
- National Vulnerability Database (NVD)
- WPScan