critical · CVSS v3 9.1

CVE-2026-123091

The Vigilant WordPress plugin before version 2.11.0 fails to enforce two‑factor authentication on non‑default login forms. This flaw allows

Overview

The Vigilant WordPress plugin before version 2.11.0 fails to enforce two‑factor authentication on non‑default login forms. This flaw allows an attacker who knows a user’s password to bypass the second factor and log in as that user. The vulnerability is critical and can lead to unauthorized account takeover.

Description

The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user.

Impact

Confidentiality: attackers can access private user data. Integrity: attackers can modify content or settings. Availability: potential for site disruption if attackers lock out legitimate users. The primary impact is on site administrators, content editors, and end‑users who rely on the plugin’s 2FA.

Remediation

Update the Vigilant plugin to version 2.11.0 or later. Verify that two‑factor authentication is enabled for all login endpoints, including custom forms. If the plugin is not required, consider disabling or removing it. Monitor authentication logs for suspicious activity.

Risk context

Severity is critical with a CVSS v3 score of 9.1. No EPSS data is available, but the flaw permits immediate account takeover if exploited. Defenders should treat this as a high‑priority issue.

Affected products

  • WordPress Vigilant plugin

Scores

Severity
critical
CVSS v2
6.4
CVSS v3
9.1
CVSS v4
—
EPSS
—

wordpress plugin two-factor authentication critical login vigilant

← All CVEs

Related CVEs

critical

CVE-2026-119506

Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.

View analysis

critical

CVE-2026-124560

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

View analysis

critical

CVE-2026-113363

NEC WebSAM WinShare versions 7.2.0-7.5.0, 7.6.0, and 7.7.0-7.7.2 on Windows contain an input validation flaw that allows a remote unauthenticated attacker to send a crafted packet and execute arbitrary commands with SYSTEM privileges. The vulnerability can compromise the entire host and expose sensitive data. It affects organizations using these WinShare versions.

View analysis

critical

CVE-2026-113364

NEC WebSAM WinShare on Windows has a critical buffer overflow that allows a remote unauthenticated attacker to execute code with SYSTEM privileges. The flaw exists in versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2. It can be triggered by sending a crafted packet with a malformed data size value in the protocol header.

View analysis