CVE-2026-110956: asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation

Q: Which sites are exposed to this issue?

Sites using the asVereinbase WordPress plugin at a version earlier than 1.1.8 are affected. The issue permits login as any user, including administrator accounts.

Q: What does an attacker need to exploit the bypass?

An attacker does not need to be authenticated. The vulnerable authentication flow can accept an empty stored value as a match, without requiring a valid password or genuine second factor.

Q: Is administrator takeover possible?

Yes. The issue allows an unauthenticated attacker to authenticate as any user, including an administrator.

Published Oct 24, 2026

Updated

The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.

Affected Software

1 affected component

asVereinbase asVereinbase WordPress plugin<1.1.8

Event History

Oct 24, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which sites are exposed to this issue?

Sites using the asVereinbase WordPress plugin at a version earlier than 1.1.8 are affected. The issue permits login as any user, including administrator accounts.

What does an attacker need to exploit the bypass?

An attacker does not need to be authenticated. The vulnerable authentication flow can accept an empty stored value as a match, without requiring a valid password or genuine second factor.

Is administrator takeover possible?

Yes. The issue allows an unauthenticated attacker to authenticate as any user, including an administrator.