CVE-2026-110960: Auth Armor <= 1.0.3 - Unauthenticated Account Takeover

Q: Who can exploit this issue?

Any unauthenticated attacker can exploit the affected handlers; no existing WordPress account or login is required.

Q: What does exploitation allow an attacker to do?

The exposed handlers can leak the site's stored API credentials and let an attacker reset an administrator's enrollment, enabling takeover of that administrator account.

Q: Which plugin versions are affected?

Auth Armor versions through 1.0.3 are affected.

Published Nov 15, 2026

Updated

The Auth Armor WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account.

Affected Software

0 affected components

Event History

Nov 15, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated attacker can exploit the affected handlers; no existing WordPress account or login is required.

What does exploitation allow an attacker to do?

The exposed handlers can leak the site's stored API credentials and let an attacker reset an administrator's enrollment, enabling takeover of that administrator account.

Which plugin versions are affected?

Auth Armor versions through 1.0.3 are affected.

CVE-2026-110960: Auth Armor <= 1.0.3 - Unauthenticated Account Takeover

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does exploitation allow an attacker to do?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does exploitation allow an attacker to do?

Which plugin versions are affected?