---
id: CVE-2026-110956
title: >-
  asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA
  Validation
summary: >-
  The asVereinbase  WordPress plugin before 1.1.8 does not require a valid
  password or a genuine second factor before authenticating a user, treating an
  empty stored value as a match, so an unauthenticated attacker can log in as
  any user, …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-287
product: asVereinbase
affected:
  - asVereinbase < 1.1.8
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-24T14:33:54.717447Z'
published: '2026-10-24'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:36:54.674Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110956'
references:
  - url: 'https://wpscan.com/vulnerability/95501052-9f20-4391-9171-184cd2e4a445/'
tags:
  - cve.org
epss: 0.0036
epssPercentile: 0.29656
ingestedAt: '2026-10-24T06:53:46.603Z'
---

## Overview

The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.

## Affected

- `asVereinbase < 1.1.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.