CVE-2026-110956 Details
Description
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.
A vulnerability in the asVereinbase WordPress plugin, affecting versions prior to 1.1.8, allows for authentication bypass. The plugin does not require a valid password or a genuine second factor for authentication, instead treating an empty stored value as a match. This flaw enables an unauthenticated attacker to log in as any user, including administrators.
Users are advised to update to version 1.1.8 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 24, 2026CISA-ADP
Assessed Oct 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/95501052-9f20-4391-9171-184cd2e4a445/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| asVereinbase | < 1.1.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 24, 2026 | CVE Modified | CISA-ADP |
| Oct 24, 2026 | New CVE Received | [email protected] |