asVereinbase EUVD-2026-109225

The target site must have the asVereinbase WordPress plugin installed and active at a version before 1.1.8, and that plugin must be the authentication/second-factor path being invoked. Exploitation requires no valid password and no genuine second factor because the plugin treats an empty stored value as a match; no special configuration, user interaction, or prior authentication is needed (CVSS PR:N/UI:N/AC:L). The only meaningful limiters are deployment-based: the plugin must be present and in the vulnerable range, and the attacker benefits from knowing a target account name (e.g. an administrator login). The specific code path that produces the empty-value match is not further detailed in the available sources.

The signals are genuinely split and should be read together. CVSS 3.1 rates this 9.8 Critical with AV:N/AC:L/PR:N/UI:N, which matches the described flaw precisely: an authentication routine that treats an empty stored value as a valid match lets an unauthenticated network attacker log in as any user, including an administrator, with full confidentiality, integrity and availability impact on the affected site. The vuln.today decision label is act_now, consistent with a trivially exploitable pre-auth admin-takeover bug, and WPScan is a credible reporter. Counterbalancing this, the EPSS score is only 0.19% (8th percentile) and the vulnerability is NOT in CISA KEV, so there is no evidence of active or widespread exploitation yet. The PoC is a reference only and is not verified as working exploit code. The low EPSS most plausibly reflects the plugin's small deployment footprint rather than any difficulty of exploitation - the mechanism itself is easy. Net: for any site actually running asVereinbase before 1.1.8 this is a maximum-urgency patch-now issue because exploitation is trivial and grants admin; across the broader internet the aggregate risk is modest simply because few sites run this plugin. No signals conflict on severity; the EPSS-vs-CVSS gap reflects prevalence, not a dispute about exploitability.

An unauthenticated attacker reaches the WordPress login path of a site running asVereinbase before 1.1.8 and submits a login for a known or guessed account (e.g. 'admin'). Because the plugin treats an empty stored credential/second-factor value as a match, the broken check passes and the attacker is authenticated as that user without a valid password or genuine second factor. A public PoC reference exists but is not verified as working exploit code; CVSS AV:N/AC:L/PR:N/UI:N indicates the attack needs no privileges, no user interaction and low complexity.