External risk intelligence

Advanced IP Blocker WordPress Plugin Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-104732

The vulnerability exists in a WordPress plugin designed for security and access control. WordPress sites are frequently deployed as internet-facing web applications, and plugins that manage login, authentication, or security features are inherently exposed to the public-facing login interface of the site, making them accessible to any remote, unauthenticated visitor.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Advanced IP Blocker WordPress plugin allows unauthenticated attackers to bypass authentication for two-factor enabled accounts, potentially leading to complete site takeover. This issue stems from insufficient server-side checks during the two-factor authentication process, enabling attackers to gain administrative access without needing the account password.

Bypass login for any user with 2FA.
Critical for WordPress site security and integrity.
Confirm plugin relevance and check for exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass WordPress authentication for any 2FA-enabled account, including administrators, by exploiting a flaw in the Advanced IP Blocker plugin. This bypass allows them to gain full control of the website without needing the account password. The attack involves submitting a two-factor authentication code without prior password verification, leading to a fully authenticated session.

Attacker needs a known user ID.
Triggered by submitting TOTP code.
Complete site takeover possible.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could bypass two-factor authentication for any user account, including administrators, on a WordPress site using the Advanced IP Blocker plugin. This could allow an attacker to gain complete control of the website by successfully guessing a 6-digit TOTP code without needing the account password.

Website administrative access.
Bypassing authentication via predictable nonces.
Complete site takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action likely falls to the WordPress site administrators or the platform team responsible for managing the WordPress instance. The initial practical step involves identifying all WordPress sites utilizing the Advanced IP Blocker plugin, confirming if the 2FA feature is enabled and actively used, and then determining the business criticality of each affected instance. Once ownership is confirmed, a remediation plan should be developed based on the identified risk.

Identify and confirm affected WordPress instances.
Verify 2FA feature usage and asset criticality.
Plan remediation considering operational impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Advanced IP Blocker plugin for WordPress?

Advanced IP Blocker is a security plugin designed for WordPress environments. Beyond its primary function of restricting network access by IP address, it includes additional modules for managing user authentication, specifically adding two-factor authentication (2FA) layers to the standard WordPress login workflow to enhance site security.

What does CWE-287 mean for CVE-2026-104732?

CWE-287 stands for Improper Authentication. In the context of this vulnerability, it means the software fails to correctly verify the identity of a user during the login process. The plugin allows the authentication sequence to be bypassed entirely because it does not confirm that the first step of the login, such as a password, was successfully completed before allowing the second-step TOTP code submission.

How can an attacker trigger this authentication bypass?

An attacker triggers the vulnerability by targeting a user account that has 2FA enabled within the plugin. The flaw allows them to interact directly with the 2FA submission process without providing a password. Simply interacting with the login interface with a valid username does not trigger the bug; the attacker must specifically reach the plugin's 2FA verification step and attempt to brute-force the 6-digit TOTP code.

How relevant is this vulnerability to my web server?

According to Halo Surface Signal, this vulnerability is highly relevant because the plugin functions as an extension of the WordPress login interface, which is inherently internet-facing. Because the plugin manages security features, it is accessible to any remote visitor, making WordPress sites using this plugin particularly exposed to unauthenticated external actors.

What should I do if I use this plugin?

Your first step is to perform an inventory of your WordPress environment to locate all instances where Advanced IP Blocker is installed. Once you have identified these instances, prioritize checking if the 2FA feature is currently enabled and active for users, as this determines the immediate risk level. After confirming these details, initiate a remediation plan to update the software or mitigate risk according to your organization's security policy.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.