CVE-2026-42411

CloudSecure WP Security <= 1.4.7 - Two-Factor Authentication Bypass

2026-05-28 00:00
0xzenko

Strategic Overview

Status
Patched in 1.4.8
Affected Version
<= 1.4.7
CVSS
5.3Medium
Weakness type
CWE-289 · Authentication Bypass by Alternate Name
CVE
CVE-2026-42411
View all CloudSecure WP Security vulnerabilities

At a glance

CVE-2026-42411 is a medium-severity Authentication Bypass by Alternate Name vulnerability in the CloudSecure WP Security WordPress plugin, affecting versions <= 1.4.7. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 1.4.8; sites on affected versions should update now. Disclosed May 2026, reported by 0xzenko.

Vulnerability Overview

The CloudSecure WP Security plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and including, 1.4.7. This makes it possible for unauthenticated attackers to bypass two-factor authentication.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-289: Authentication Bypass by Alternate Name

Reaching this weakness in CloudSecure WP Security <= 1.4.7 takes a caller who can reach the endpoint. Authentication bypass by alternate name means access checks are performed against one form of an identifier while the sensitive operation uses another, so a differently spelled value slips through.

Registering or supplying a variant spelling of a privileged account's identifier is enough to be treated as that account. For CloudSecure WP Security the fix is 1.4.8: builds <= 1.4.7 are affected, anything from 1.4.8 onward is not.

Remediation

Update to version 1.4.8, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: CloudSecure WP Security 1.4.8 closes this, and updating the plugin is the step that ends it.

  • Alerts

External References

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C