WordPress Security Plugin CVE-2026-114443

Exploitable only when the target runs this plugin at a version before 2.191 AND the account has the authenticator-app (TOTP) two-factor method enabled. The decisive precondition is that the attacker must possess the victim's current, valid, time-limited authenticator code; given that, the plugin accepts the code at login without verifying the account password, yielding login as that user (up to administrator). Limiting factors: the TOTP value is short-lived and must be captured per target per login (phishing, device access, or shoulder-surfing), there is no mass-exploitation path, and sites not using authenticator-app 2FA on this plugin are unaffected.

Signals are consistent and point to a real but non-emergency, conditionally-exploitable issue. The vendor-supplied CVSS (7.5, AV:N/AC:H/PR:L/UI:N/C:H/I:H/A:H) reflects full account compromise reachable over the network but with high attack complexity, matching the core prerequisite in the description: the attacker must already hold the victim's current authenticator-app code. EPSS is low (0.13%, 3rd percentile) and SSVC records Exploitation: none and Automatable: no, which agrees with the mechanism - this cannot be sprayed broadly because each attempt needs a specific user's live TOTP value, so it favors targeted abuse over mass exploitation. It is NOT in CISA KEV and no public exploit is identified in the input, so the vuln.today 'this_week' priority (driven by Technical Impact: total - administrator takeover) is about prompt patching, not incident response. One tension worth noting: SSVC rates Technical Impact 'total' while EPSS/automatable signals are low, which is the expected pattern for a high-impact but access-gated flaw rather than a contradiction. Net: a genuine fix-this-week authentication-bypass issue, not a widespread-exploitation emergency.

An attacker who has transiently obtained a user's current authenticator-app code - for example via a phishing page that captures one OTP, shoulder-surfing, or brief access to the victim's device - submits that code at the plugin's two-factor login step without ever supplying the account password. Because the plugin accepts the authenticator code without first verifying the password, the attacker is logged in as that user, including an administrator. No public exploit code is identified in the provided data.