CloudSecure WP Security <= 1.4.7 - Two-Factor Authentication Bypass
Strategic Overview
- Status
- Patched in 1.4.8
- Affected Plugin
- CloudSecure WP Security
- Affected Version
<= 1.4.7- CVSS
- 5.3Medium
- Weakness type
- CWE-289 · Authentication Bypass by Alternate Name
- CVE
CVE-2026-42411
At a glance
CVE-2026-42411 is a medium-severity Authentication Bypass by Alternate Name vulnerability in the CloudSecure WP Security WordPress plugin, affecting versions <= 1.4.7. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 1.4.8; sites on affected versions should update now. Disclosed May 2026, reported by 0xzenko.
Vulnerability Overview
The CloudSecure WP Security plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and including, 1.4.7. This makes it possible for unauthenticated attackers to bypass two-factor authentication.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-289: Authentication Bypass by Alternate Name
Reaching this weakness in CloudSecure WP Security <= 1.4.7 takes a caller who can reach the endpoint. Authentication bypass by alternate name means access checks are performed against one form of an identifier while the sensitive operation uses another, so a differently spelled value slips through.
Registering or supplying a variant spelling of a privileged account's identifier is enough to be treated as that account. For CloudSecure WP Security the fix is 1.4.8: builds <= 1.4.7 are affected, anything from 1.4.8 onward is not.
Remediation
Update to version 1.4.8, or a newer patched version
How does WordSec protect against this?
The fix is the thing that ends this: CloudSecure WP Security 1.4.8 closes this, and updating the plugin is the step that ends it.
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C