How does Advanced IP Blocker flaw CVE-2026-104732 let attackers bypass 2FA to seize WordPress admin control?

The Advanced IP Blocker plugin for WordPress contains a critical authentication bypass vulnerability that allows unauthenticated attackers to seize full control of affected sites. According to the National Vulnerability Database record for CVE-2026-104732, the flaw carries a CVSS score of 9.8, rated as critical. The vulnerability exists in all plugin versions up to and including 8.13.13.

How does the authentication bypass work?

The vulnerability stems from a flaw in the `handle_login_action()` function, which fails to perform server-side checks to verify that a requester completed the initial password authentication step. According to the NVD description, the function processes step-2 TOTP submissions for a posted `user_id` without confirming prior login success. This allows attackers to skip the password requirement entirely.

Compounding the issue, an error branch in the function unconditionally generates a fresh `advaipbl-2fa-interim-{user_id}` nonce. This nonce is delivered in a `Location` header to any unauthenticated caller. Subsequently, `display_2fa_login_form_step_2()` renders a valid `advaipbl-2fa-verify-{user_id}` nonce in HTML. Both nonces are computed against a fixed `uid=0` empty-session context, making them fully reusable by attackers across subsequent requests.

What is the impact on organizations?

Successful exploitation allows unauthenticated attackers to bypass authentication entirely for any account with the plugin’s two-factor authentication feature enabled, including administrator accounts. According to the source material, attackers can achieve this by brute-forcing an unthrottled six-digit TOTP code. The system lacks an attempt counter, account lockout mechanisms, and does not fire `wp_login_failed` events during these attempts.

Attackers receive a fully authenticated session cookie via `wp_set_auth_cookie` without ever supplying the account password. This results in complete site takeover. Exploitation requires only a known `user_id` for an account that has the plugin's 2FA feature enabled. The weakness is classified as CWE-287, indicating an improper authentication mechanism.

Which versions are affected?

The vulnerability affects the Advanced IP Blocker plugin for WordPress in all versions up to and including 8.13.13. According to the NVD record, the issue is present in the plugin developed by inilerm. There is no indication in the source material that a patch or fix has been released for versions beyond 8.13.13.

Organizations using this plugin must verify their installed version against the affected range. Any installation running version 8.13.13 or earlier is vulnerable to this critical authentication bypass. The lack of throttling on the TOTP verification process makes automated exploitation feasible for attackers who can identify valid user IDs.

What should administrators do next?

Administrators should immediately audit their WordPress installations for the Advanced IP Blocker plugin. According to the source material, no fix has been confirmed yet for versions beyond 8.13.13. Organizations should monitor vendor announcements for updates.

Security teams should review logs for unusual authentication patterns, particularly repeated failed TOTP submissions that do not trigger standard login failure alerts. Since the flaw allows session cookie issuance without password verification, monitoring for new admin sessions from unexpected sources is critical.

What to do and how to stay safe: Advanced IP Blocker

• Audit all WordPress installations for the Advanced IP Blocker plugin and check if the version is 8.13.13 or lower.
• Monitor server logs for repeated TOTP verification attempts that do not correspond with standard login failure events.
• Restrict access to the WordPress admin login page by IP address where possible to reduce exposure to brute-force attacks.
• Prepare to remove or replace the plugin if a patch is not provided promptly, as the vulnerability allows complete site takeover.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability require the attacker to know the user's password?

No, the vulnerability allows unauthenticated attackers to bypass the password requirement entirely by exploiting the 2FA verification process.

What is the CVSS score for CVE-2026-104732?

The National Vulnerability Database rates CVE-2026-104732 with a CVSS score of 9.8, which is considered critical.

Which plugin versions are vulnerable to this authentication bypass?

All versions of the Advanced IP Blocker plugin for WordPress up to and including 8.13.13 are vulnerable.