Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) <= 5.4.0 — Authenticated (Subscriber+) Two-Factor Authentication Bypass

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under All-In-One Security (AIOS) – Security and Firewall.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 5.5.0, or a newer patched version
2. Update to version 1.17.0, or a newer patched version
3. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
4. Watch All-In-One Security (AIOS) – Security and Firewall to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Karol Czubernat.

The Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 plugins for WordPress are vulnerable to Two-Factor Authentication Bypass . This is due to failure to bind the two-factor code verification step to the specific account undergoing authentication, allowing codes from unrelated accounts to satisfy another account's second-factor check. This makes it possible for authenticated attackers, with subscriber-level access and above, to bypass the victim's two-factor authentication requirement by supplying a valid code from the attacker's own 2FA-enabled account, thereby obtaining an authenticated session as the victim. The attacker must possess a separate WordPress account with two-factor authentication enabled and must know the target account's password.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Oct 27, 2026

   CVE published

   Severity medium, CVSS 4.3

2. Nov 13, 2026

   Record last updated