EUVD-2026-68797
GHSA-72r6-f47g-xffm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable login endpoint requires no credentials (PR:N) but elevated complexity to spoof 2FA state (AC:H); successful bypass yields full WordPress site compromise (C:H/I:H/A:H) within unchanged scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
AnalysisAI
Authentication bypass in the SiteGround Security WordPress plugin (versions ≤ 1.6.6) enables unauthenticated remote attackers to circumvent two-factor authentication protections and obtain fully authenticated WordPress sessions. Classified as CWE-290 (Authentication Bypass by Spoofing), this network-exploitable flaw carries a CVSS 8.1 score with full high impact across confidentiality, integrity, and availability, moderated only by elevated attack complexity (AC:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a WordPress site with the SiteGround Security plugin installed and active in a version at or below 1.6.6, with two-factor authentication explicitly enabled and enforced for the targeted account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a genuine high-severity risk: the vulnerability is network-accessible with no authentication prerequisite and no user interaction required, and successful exploitation yields full site compromise across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Administrators should update the SiteGround Security plugin to the latest available release beyond version 1.6.6 immediately; however, no exact patched version number was confirmed in the available input data, and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/sg-security/vulnerability/wordpress-siteground-security-plugin-1-6-6-2fa-bypass-vulnerability should be consulted for the confirmed fix version before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress installations using SiteGround Security plugin version 1.6.6 or earlier and immediately deactivate the plugin to block exploitation vectors; enable alternative 2FA solutions via core WordPress authentication, Wordfence, Sucuri, or iThemes Security. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Siteground Security
View allThe SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL qu
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today