Update Advanced IP Blocker to Stop Unauthenticated 2FA Bypass and Full Site Takeover

The Advanced IP Blocker plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to and including 8.13.13. According to the National Vulnerability Database, this flaw allows unauthenticated attackers to gain full access to accounts protected by two-factor authentication. The issue stems from a failure in the plugin’s login handling logic, which permits attackers to skip the initial password verification step entirely.

Root cause

The vulnerability exists because the `handle_login_action()` function performs no server-side checks to verify that a requester completed the first step of password authentication. According to the NVD record, the function processes step-2 Time-based One-Time Password submissions for a posted `user_id` without validating prior session markers or transients. This design flaw allows the system to accept TOTP inputs from users who have not yet proved their identity through the primary credential gate.

Compounding the issue, an error branch within the function unconditionally generates a fresh `advaipbl-2fa-interim-{user_id}` nonce. The system delivers this nonce in a `Location` header to any unauthenticated caller. Subsequently, the `display_2fa_login_form_step_2()` function renders a valid `advaipbl-2fa-verify-{user_id}` nonce in the HTML response. Both nonces are computed against a fixed `uid=0` empty-session context, making them fully reusable by attackers across subsequent requests.

Attack path

Unauthenticated attackers can exploit this vulnerability by targeting any account that has the plugin’s two-factor authentication feature enabled. According to the source material, exploitation requires only a known `user_id` for the target account. Attackers can then brute-force the unthrottled 6-digit TOTP code without facing any attempt counters or account lockout mechanisms. The system does not fire `wp_login_failed` events during these attacks, leaving no standard audit trail for defenders to detect the intrusion attempts.

Upon successfully guessing the TOTP code, the attacker receives a fully authenticated session cookie via `wp_set_auth_cookie`. This occurs without the attacker ever supplying the account’s actual password. The result is complete site takeover, granting the attacker the same privileges as the legitimate user. This includes administrative access if the targeted account holds such permissions, allowing for full control over the WordPress installation.

Affected versions

The vulnerability affects the Advanced IP Blocker plugin for WordPress developed by inilerm. According to the NVD record, all versions up to and including 8.13.13 are vulnerable to this authentication bypass. Users running any version within this range are exposed to the risk of unauthenticated account takeover. There is no mention in the source material of a patched version being available yet.

Mitigation

• Identify all WordPress sites running the Advanced IP Blocker plugin.
• Check the installed version against the affected range of up to 8.13.13.
• Monitor server logs for unusual login activity or high volumes of TOTP submissions.
• Consider disabling the plugin’s two-factor authentication feature if no patch is available.

What to do and how to stay safe: WordPress

• Audit your WordPress installations to determine if the Advanced IP Blocker plugin is installed and check its version number.
• Review server access logs for patterns indicating brute-force attempts on TOTP endpoints, especially from unauthenticated sources.
• Implement network-level rate limiting on login endpoints to slow down automated guessing attacks while a fix is pending.
• Once the vendor provides an update, apply the patch immediately to all affected sites to close the authentication bypass vector.

Step-by-step guide: Vulnerability Management Definition and Process

General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-104732?

The National Vulnerability Database rates the severity of CVE-2026-104732 as 9.8, which is classified as critical.

Can attackers bypass the password requirement with this vulnerability?

Yes, attackers can bypass the password requirement entirely by brute-forcing the 6-digit TOTP code without ever supplying the account password.

Does the plugin log failed login attempts during this attack?

No, the source material states that no `wp_login_failed` events are fired, meaning standard WordPress login failure logs will not record these attacks.