{"id":"CVE-2026-111739","title":"Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter","summary":"The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS)  WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker wh…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-287"],"product":"Two Factor Authentication","affected":["two_factor_authentication < 1.17.0","all-in-one_security_aios < 5.5.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-29T10:49:55.598540Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T10:56:06.577Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111739","references":[{"url":"https://wpscan.com/vulnerability/32371146-ddd8-4cb1-8a80-65de2d25319f/"}],"tags":["cve.org"],"epss":0.00286,"epssPercentile":0.21304,"ingestedAt":"2026-11-01T17:57:46.219Z","slug":"CVE-2026-111739","body":"## Overview\n\nThe Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS)  WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.\n\n## Affected\n\n- `two_factor_authentication < 1.17.0`\n- `all-in-one_security_aios < 5.5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}