CVE-2026-123091: Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms

Q: What conditions are required to exploit this issue?

An attacker must know a valid user's password and must be able to authenticate through a login form other than the default WordPress login form. The bypass skips Vigilant's second-factor check in versions before 2.11.0.

Q: Which deployments are exposed?

WordPress sites using the Vigilant plugin before version 2.11.0 are affected if they provide or permit authentication through third-party login forms. The available information does not establish whether a default WordPress-only login configuration is affected.

Q: How can I reduce risk before updating?

Restrict or disable non-default and third-party login forms where possible, so authentication occurs through the default WordPress login form. Also treat potentially exposed account passwords as sensitive because password knowledge is required for exploitation.

Published Nov 9, 2026

Updated

The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user.

Affected Software

1 affected component

Vigilant Vigilant WordPress plugin<2.11.0

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

What conditions are required to exploit this issue?

An attacker must know a valid user's password and must be able to authenticate through a login form other than the default WordPress login form. The bypass skips Vigilant's second-factor check in versions before 2.11.0.

Which deployments are exposed?

WordPress sites using the Vigilant plugin before version 2.11.0 are affected if they provide or permit authentication through third-party login forms. The available information does not establish whether a default WordPress-only login configuration is affected.

How can I reduce risk before updating?

Restrict or disable non-default and third-party login forms where possible, so authentication occurs through the default WordPress login form. Also treat potentially exposed account passwords as sensitive because password knowledge is required for exploitation.

CVE-2026-123091: Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms

Affected Software

Event History

Frequently Asked Questions

What conditions are required to exploit this issue?

Which deployments are exposed?

How can I reduce risk before updating?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to exploit this issue?

Which deployments are exposed?

How can I reduce risk before updating?