A newly tracked flaw, CVE-2026-104732, hits the Advanced IP Blocker plugin for WordPress in all versions through 8.13.13. The bug lives in the plugin's login handler, which processes a two-factor code submission for an attacker-chosen user ID without first confirming that the password step actually succeeded, and an error path even issues a fresh interim authentication token on failure. That combination could let an attacker skip past the password check and still end up with a valid two-factor session for someone else's account.
// source: nvd.nist.gov ↗