CVE-2026-111739: Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Two Factor Authentication WordPress pluginto a version that resolves this vulnerability.Fixed in 1.17.0 - Upgrade
Upgrade
All-In-One Security (AIOS) WordPress pluginto a version that resolves this vulnerability.Fixed in 5.5.0
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to know the victim's password and have their own account with two-factor authentication enabled. They can then use a valid code from their own account to complete the victim's second-factor check.
Who is exposed to account takeover?
Accounts protected by affected versions of either plugin are exposed if an attacker obtains the account password. The issue allows the attacker to obtain the victim's authenticated session without possessing the victim's second-factor code.
Which plugin versions need to be remediated?
Two Factor Authentication versions before 1.17.0 and All-In-One Security (AIOS) versions before 5.5.0 are affected. Upgrade to a version that is not listed as affected.