What is the CVSS score of EUVD-2026-47885?

EUVD-2026-47885 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Security Ninja Premium are affected by EUVD-2026-47885?

Security Ninja Premium WordPress plugin versions before 5.290 contain a two-factor authentication bypass that allows attackers with valid account credentials to skip the second-factor requirement and…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-47885?

Yes, a public proof-of-concept exploit is available for EUVD-2026-47885. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-47885?

Within 24 hours, identify all WordPress sites running Security Ninja Premium and verify the currently installed version; temporarily disable the plugin on any instance running versions prior to 5.290 as an interim containment measure if immediate patching is not possible. Within 7 days, update Security Ninja Premium to version 5.290 or later across all WordPress installations; review admin account access logs from the past 30 days for suspicious login patterns or unauthorized access attempts. Within 30 days, conduct a full audit of all administrator accounts to detect any unauthorized modifications, and implement additional controls such as IP whitelisting or password reset requirements for administrative users.

Security Ninja Premium EUVD-2026-47885

| CVE-2026-14291 HIGH

Improper Authentication (CWE-287)

2026-07-23 WPScan

GHSA-8p8v-838m-f36p

WordPress Authentication Bypass Security Ninja Premium Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.4 HIGH

AC:H because the attacker must already know a valid password; PR:N as no session or privilege is held pre-attack; C:H/I:H reflect full account/admin takeover, A:N as availability is unaffected.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 16:06 vuln.today

Patch available

Jul 23, 2026 - 10:02 EUVD

CVE Published

Jul 23, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 23, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.

AnalysisAI

Two-factor authentication bypass in the Security Ninja Premium WordPress plugin (all versions before 5.290) lets a remote attacker who already knows a valid account password log in without supplying the one-time code, defeating enforced 2FA for any user including administrators. One of the plugin's two 2FA code paths never validates the second factor, so the protection can be silently skipped. Publicly available exploit code exists (published by WPScan) and a vendor patch is available; EPSS is low at 0.25% (17th percentile), indicating no evidence of widespread automated exploitation despite the POC.

Technical ContextAI

The vulnerability sits in the premium two-factor authentication module of Security Ninja, a security-hardening plugin for WordPress. WordPress core authenticates via username/password and delegates the optional second factor to plugins hooked into the login flow. Here, the plugin exposes two distinct 2FA verification code paths and one of them fails to verify the submitted OTP before granting a session, an instance of CWE-287 (Improper Authentication) - specifically a missing verification step rather than a weak or guessable secret. Because the flaw is in the enforcement logic, the OTP requirement becomes advisory: an attacker routing through the unchecked path is treated as fully authenticated. The affected component is identified in CPE data as cpe:2.3:a:unknown:security-ninja-premium and, per the vendor, ships only in the premium (paid) build, so free-tier installs are not affected.

RemediationAI

Vendor-released patch: upgrade Security Ninja Premium to version 5.290 or later, which restores second-factor verification across both authentication code paths; this is the primary and complete fix. Until the update can be applied, reduce exposure by treating the password as the only remaining barrier: force a site-wide password reset for privileged accounts and enforce strong, unique passwords, since the bypass only helps an attacker who already knows a password. As a compensating control, restrict access to wp-login.php and the admin area by IP allowlisting or a WAF/reverse-proxy rule, and enable login rate-limiting to slow the credential-stuffing that would supply the required password, with the trade-off that IP restrictions can lock out legitimate remote admins and must be maintained. Alternatively, temporarily disable the Security Ninja two-factor module and substitute a separate, unaffected 2FA plugin if immediate patching is not possible, accepting the operational overhead of reconfiguring users. Refer to the WPScan advisory (https://wpscan.com/vulnerability/e62cfba9-4956-43ba-8554-6cdb0eb8815b/) for authoritative guidance.