CVE-2026-104732 Details

A vulnerability allowing authentication bypass has been identified in the Advanced IP Blocker plugin for WordPress, affecting all versions through 8.13.13. The issue arises because the 'handle_login_action()' function does not perform necessary server-side checks to ensure that a user has completed the first step of password authentication before processing the second step of two-factor authentication (TOTP) for the specified 'user_id'. This flaw is exacerbated by an error branch in the function that automatically generates a new 'advaipbl-2fa-interim-{user_id}' nonce and sends it in a 'Location' header to any unauthenticated user. Subsequently, the 'display_2fa_login_form_step_2()' function provides a valid 'advaipbl-2fa-verify-{user_id}' nonce in HTML. Both nonces are based on a fixed 'uid=0' empty-session context, making them fully reusable by an attacker in future requests. As a result, unauthenticated attackers can completely bypass authentication for any account with two-factor authentication enabled, including administrators. Exploitation involves brute-forcing an unthrottled 6-digit TOTP code, without triggering an attempt counter, account lockout, or the 'wp_login_failed' action. Once the correct code is entered, the attacker receives a fully authenticated session cookie via 'wp_set_auth_cookie', all without ever entering the account password, leading to a complete takeover of the site.

Users are advised to update the Advanced IP Blocker plugin to version 8.13.14 or a newer patched version.