Critical Auth Bypass in WordPress Advanced IP Blocker Plugin Allows Unauthenticated Access
A flaw in the Advanced IP Blocker plugin lets attackers bypass passwords and 2FA to take over WordPress sites using known user IDs.
Key points
- CVE-2026-104732 is rated Critical with a CVSS score of 9.8.
- The vulnerability affects Advanced IP Blocker versions up to and including 8.13.13.
- Attackers can bypass authentication by brute-forcing unthrottled TOTP codes.
A critical authentication bypass vulnerability in the Advanced IP Blocker plugin for WordPress allows unauthenticated attackers to gain full access to sites, including administrative accounts, without knowing the user password. The flaw, tracked as CVE-2026-104732, affects all versions of the plugin up to and including 8.13.13 and is rated Critical with a CVSS score of 9.8 by the National Vulnerability Database.
At a glance
- CVE
- CVE-2026-104732
- Product
- inilerm Advanced IP Blocker
- CVSS
- 9.8 Critical
- Weakness
- improper authentication
- Exploited
- No known exploitation
The vulnerability stems from a logic error in the plugin’s `handle_login_action()` function. According to the NVD record, the function fails to perform server-side checks—such as transient or session markers—to verify that a requester has completed the initial password authentication step before processing a two-factor authentication (2FA) submission. This allows an attacker to skip the password requirement entirely.
Technical Context and Exploitation
The flaw is compounded by how the plugin handles error states and nonces. When the function encounters an error branch, it unconditionally generates a fresh nonce and delivers it via a `Location` header to any unauthenticated caller. Subsequently, the `display_2fa_login_form_step_2()` function renders a valid verification nonce in the HTML. Both nonces are computed against a fixed `uid=0` empty-session context, making them fully reusable by attackers across subsequent requests.
This design allows an attacker to bypass authentication for any account that has the plugin’s 2FA feature enabled. The attacker does not need the account password. Instead, they can brute-force the 6-digit Time-based One-Time Password (TOTP) code. The NVD record notes that there is no attempt counter, no account lockout mechanism, and no `wp_login_failed` event firing during this process. Once the correct TOTP code is guessed, the attacker receives a fully authenticated session cookie via `wp_set_auth_cookie`, resulting in complete site takeover.
Affected Systems
The vulnerability affects the Advanced IP Blocker plugin developed by inilerm. All versions up to and including 8.13.13 are vulnerable. Exploitation requires only a known `user_id` for an account that has the plugin's 2FA feature enabled. This includes administrator accounts, meaning a successful attack grants the attacker full control over the WordPress installation.
What should you do?
No fix has been confirmed yet. Site administrators should assess their exposure by checking if the Advanced IP Blocker plugin is installed and if any accounts have its 2FA feature enabled. Monitor for unusual login activity or session changes. Once the vendor provides an update, apply it immediately. In the interim, consider restricting access to login pages by IP address if feasible.
What to do and how to stay safe: Advanced IP Blocker
- Audit your WordPress plugins to determine if Advanced IP Blocker is installed and identify the current version.
- Review user accounts to see which ones have the plugin’s 2FA feature enabled, as these are the primary targets.
- Monitor server logs and authentication logs for repeated failed login attempts or unusual session creations, which may indicate brute-force activity.
- Implement network-level restrictions on login endpoints to limit exposure while awaiting a vendor patch.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-104732?
It is a critical authentication bypass vulnerability in the Advanced IP Blocker WordPress plugin that allows attackers to bypass passwords and 2FA.
Which versions of Advanced IP Blocker are affected?
All versions up to and including 8.13.13 are affected by this vulnerability.
How can an attacker exploit this flaw?
An attacker can exploit the flaw by brute-forcing an unthrottled 6-digit TOTP code for a known user ID, bypassing the need for a password.
