Key points
- The vulnerability affects all versions of the Advanced IP Blocker plugin up to and including 8.13.13.
- Attackers can brute-force six-digit TOTP codes without triggering account lockouts or failure logs.
- The flaw allows unauthenticated users to gain full administrative access to affected WordPress sites.
A critical authentication bypass vulnerability, identified as CVE-2026-104732, has been disclosed in the Advanced IP Blocker plugin for WordPress. According to the National Vulnerability Database, the issue carries a CVSS score of 9.8, rated as critical. The flaw allows unauthenticated attackers to completely bypass two-factor authentication protections for any user account, including site administrators, without ever supplying the correct password.
How it unfolded
- The vulnerability exists in the plugin's `handle_login_action()` function, which fails to perform server-side checks for password authentication before processing TOTP submissions.
- An error branch in the code unconditionally generates fresh nonces for unauthenticated callers, allowing attackers to reuse these tokens across multiple requests.
- Attackers can exploit this by brute-forcing unthrottled six-digit TOTP codes, resulting in a fully authenticated session cookie via `wp_set_auth_cookie`.
Who is affected
All installations of the Advanced IP Blocker plugin by developer inilerm running versions up to and including 8.13.13 are affected by this vulnerability. The National Vulnerability Database records indicate that the flaw is present in every version of the plugin released prior to any potential patch. Any WordPress site using this plugin with two-factor authentication enabled for user accounts is at risk of complete takeover.
The impact is severe because the attack vector requires only a known `user_id` for an account that has the plugin's 2FA feature enabled. Administrators are particularly vulnerable, as gaining access to an admin account results in full control over the WordPress installation. The absence of attempt counters or account lockout mechanisms means attackers can continue guessing codes indefinitely.
What happens next
Security teams should immediately inventory their WordPress environments to identify any instances of the Advanced IP Blocker plugin. According to the NVD record, the vulnerability is classified under CWE-287, indicating an improper authentication mechanism. Sites must assess whether any user accounts, especially administrators, have 2FA enabled through this specific plugin.
No fix or updated version has been confirmed in the source material yet. Until the vendor provides an update, administrators should consider disabling the two-factor authentication features within the Advanced IP Blocker plugin to mitigate the risk. Alternative authentication methods or different security plugins may be necessary to maintain protection while this vulnerability remains unpatched.
What to do and how to stay safe: Advanced IP Blocker
- Audit your WordPress site to confirm if the Advanced IP Blocker plugin is installed and check its version against the affected range up to 8.13.13.
- Monitor server logs for unusual login activity or repeated failed attempts that might indicate exploitation of the TOTP brute-force vector.
- Implement additional network-level controls to restrict access to the login page and reduce the attack surface for unauthenticated requests.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-104732?
It is a critical authentication bypass vulnerability in the Advanced IP Blocker WordPress plugin that allows unauthenticated attackers to bypass 2FA.
Which versions of the plugin are affected?
All versions of the Advanced IP Blocker plugin up to and including 8.13.13 are vulnerable to this authentication bypass flaw.
Can attackers log in without a password?
Yes, attackers can bypass password authentication entirely by brute-forcing unthrottled TOTP codes and receiving a valid session cookie.
