Two-factor authentication bypass in Vigilant WordPress plugin
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA.
Summary
The Vigilant WordPress plugin before 2.11.0 does not enforce two-factor authentication on login forms other than the default WordPress one. An attacker who knows a user's password can skip the second factor and log in as that user. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
Description from the CNA
The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Vigilant | before 2.11.0 | 2.11.0 | Patch available | CNA |
- Vigilant VendorUnknown Affected before 2.11.0 Fixed in 2.11.0 Patch available CNA
Remediation
Upgrade the Vigilant WordPress plugin to version 2.11.0, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-09
- Fix · CNA Vigilant (Unknown) Fixed in 2.11.0
Timeline
- 2026-11-09 Threatist record created from CVE-2026-123091
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences