{"id":"CVE-2026-111739","aliases":["EUVD-2026-112625","GHSA-8p6c-jj8g-wm34"],"status":"published","title":"Two Factor Authentication \u003c 1.17.0 and All-In-One Security (AIOS) \u003c 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter","description":"The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS)  WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00286,"percentile":0.21439,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-10-29T06:00:25Z","modified":"2026-10-29T15:18:27Z","products":[{"vendor":"unknown","product":"all-in-one security (aios)"},{"vendor":"unknown","product":"two factor authentication"}],"references":[{"url":"https://wpscan.com/vulnerability/32371146-ddd8-4cb1-8a80-65de2d25319f/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111739"},{"url":"https://wpscan.com/vulnerability/32371146-ddd8-4cb1-8a80-65de2d25319f"},{"url":"https://github.com/advisories/GHSA-8p6c-jj8g-wm34"}],"sources":{"cve":[{"id":"CVE-2026-111739","title":"Two Factor Authentication \u003c 1.17.0 and All-In-One Security (AIOS) \u003c 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter","description":"The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS)  WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.","status":"published","published":"2026-10-29T06:00:25.291Z","modified":"2026-10-29T10:56:06.577Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:20:15.34316Z"}],"euvd":[{"id":"EUVD-2026-112625","description":"The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS)  WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.","status":"published","published":"2026-10-29T06:00:25Z","modified":"2026-10-29T10:56:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:17.279653Z"}],"ghsa":[{"id":"GHSA-8p6c-jj8g-wm34","title":"The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) ...","description":"The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS)  WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.","status":"published","published":"2026-10-29T06:30:37Z","modified":"2026-10-29T12:30:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:14:38.164928Z"}],"nvd":[{"id":"CVE-2026-111739","description":"The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS)  WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.","status":"published","published":"2026-10-29T06:17:18.627Z","modified":"2026-10-29T15:18:27.92Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:13:04.6346Z"}]}}