{"id":"CVE-2026-14291","aliases":["EUVD-2026-47885","GHSA-8p8v-838m-f36p"],"status":"published","title":"Security Ninja (Premium) \u003c 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa","description":"The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00531,"percentile":0.45239,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-07-23T06:00:02Z","modified":"2026-07-23T15:31:47Z","products":[{"vendor":"unknown","product":"security-ninja-premium"}],"references":[{"url":"https://wpscan.com/vulnerability/e62cfba9-4956-43ba-8554-6cdb0eb8815b/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14291"},{"url":"https://wpscan.com/vulnerability/e62cfba9-4956-43ba-8554-6cdb0eb8815b"},{"url":"https://github.com/advisories/GHSA-8p8v-838m-f36p"}],"sources":{"cve":[{"id":"CVE-2026-14291","title":"Security Ninja (Premium) \u003c 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa","description":"The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.","status":"published","published":"2026-07-23T06:00:02.596Z","modified":"2026-07-23T14:10:42.101Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-47885","description":"The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.","status":"published","published":"2026-07-23T06:00:02Z","modified":"2026-07-23T14:10:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:44.021778Z"}],"ghsa":[{"id":"GHSA-8p8v-838m-f36p","title":"The security-ninja-premium WordPress plugin before 5.290 does not verify the second...","description":"The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.","status":"published","published":"2026-07-23T09:31:59Z","modified":"2026-07-23T15:31:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:09:43.143268Z"}],"nvd":[{"id":"CVE-2026-14291","description":"The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.","status":"published","published":"2026-07-23T07:16:32.397Z","modified":"2026-07-23T15:16:53.917Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:32.473901Z"}]}}