Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) <= 5.4.0 - Authenticated (Subscriber+) Two-Factor Authentication Bypass
Strategic Overview
- Status
- Patched in 1.17.0
- Affected Plugin
- Two Factor Authentication
- Affected Version
< 1.17.0- CVSS
- 4.3Medium
- Weakness type
- CWE-287 · Improper Authentication
- CVE
CVE-2026-111739
At a glance
CVE-2026-111739 is a medium-severity Improper Authentication vulnerability in the Two Factor Authentication WordPress plugin, affecting versions < 1.17.0. It carries a CVSS score of 4.3 (reachable over the network; low attack complexity). Exploitation requires an authenticated account at Subscriber level or above. The issue is fixed in version 1.17.0; sites on affected versions should update now. Disclosed October 2026, reported by Karol Czubernat.
Vulnerability Overview
The Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 plugins for WordPress are vulnerable to Two-Factor Authentication Bypass . This is due to failure to bind the two-factor code verification step to the specific account undergoing authentication, allowing codes from unrelated accounts to satisfy another account's second-factor check. This makes it possible for authenticated attackers, with subscriber-level access and above, to bypass the victim's two-factor authentication requirement by supplying a valid code from the attacker's own 2FA-enabled account, thereby obtaining an authenticated session as the victim. The attacker must possess a separate WordPress account with two-factor authentication enabled and must know the target account's password.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.
CWE-287: Improper Authentication
Reaching this weakness in Two Factor Authentication < 1.17.0 takes an account at Subscriber level or above. Improper authentication means the mechanism that proves who a caller is can be satisfied without the secret it was supposed to require.
An attacker authenticates as another user — administrators included — without ever knowing a password, so password policies and login rate limits never come into play. For Two Factor Authentication the fix is 1.17.0: builds < 1.17.0 are affected, anything from 1.17.0 onward is not.
Remediation
Update to version 1.17.0, or a newer patched version
How does WordSec protect against this?
Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Two Factor Authentication 1.17.0 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C