EUVD-2026-68797
GHSA-72r6-f47g-xffm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify WordPress site with SiteGround Security ≤ 1.6.6 and 2FA enabled
-
DeliveryEnumerate valid user account
-
ExploitInitiate authentication flow
-
InstallCraft spoofed 2FA verification request (CWE-290)
-
C2Bypass second-factor validation
-
ExecuteObtain authenticated WordPress session
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a WordPress site with the SiteGround Security plugin installed and active in a version at or below 1.6.6, with two-factor authentication explicitly enabled and enforced for the targeted account. The CVSS vector (PR:N, UI:N) confirms no prior authentication or victim interaction is needed, but AC:H indicates a specific condition must be satisfied to trigger the spoofing - likely a crafted or precisely sequenced request that manipulates 2FA verification state. Sites using the SiteGround Security plugin without 2FA configured are not exposed to this specific attack vector. The attacker must be able to reach the WordPress login endpoint over the network, and must know or enumerate a valid account subject to 2FA enforcement. |
| Impact | The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a genuine high-severity risk: the vulnerability is network-accessible with no authentication prerequisite and no user interaction required, and successful exploitation yields full site compromise across confidentiality, integrity, and availability. The AC:H rating meaningfully limits risk by ruling out trivial mass-scanning exploits, suggesting that exploitation requires a targeted, crafted approach rather than opportunistic automation. EPSS data was not provided in the available intelligence, and the vulnerability does not appear in the CISA KEV catalog at time of analysis - meaning active exploitation has not been officially confirmed. No public POC has been identified, which further supports classifying this as a high-priority but not yet actively weaponized finding that warrants prompt patching for all operators with the 2FA feature enabled. |
| Exploit ScenarioDerived | An unauthenticated attacker targeting a WordPress site running SiteGround Security ≤ 1.6.6 with 2FA enabled initiates a login flow for a known or enumerated account, then crafts a spoofed or manipulated 2FA verification request that satisfies the plugin's (flawed) validation logic without possessing the actual one-time code. If the required attack complexity conditions are met, the attacker receives a fully authenticated session and gains administrative or user-level WordPress access. No public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 31, 2026
Authentication bypass in the SiteGround Security WordPress plugin (versions ≤ 1.6.6) enables unauthenticated remote attackers to circumvent two-factor authentication protections and obtain fully authenticated WordPress sessions. Classified as CWE-290 (Authentication Bypass by Spoofing), this network-exploitable flaw carries a CVSS 8.1 score with full high impact across confidentiality, integrity, and availability, moderated only by elevated attack complexity (AC:H). No public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Administrators should update the SiteGround Security plugin to the latest available release beyond version 1.6.6 immediately; however, no exact patched version number was confirmed in the available input data, and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/sg-security/vulnerability/wordpress-siteground-security-plugin-1-6-6-2fa-bypass-vulnerability should be consulted for the confirmed fix version before deploying. As a compensating control prior to patching, administrators may restrict access to wp-login.php via IP allowlist or firewall rules to reduce the network-accessible attack surface, though this does not eliminate the vulnerability and will impact legitimate remote logins. Temporarily disabling the SiteGround Security plugin's 2FA feature is a last-resort option that removes the vulnerable code path but eliminates the second authentication factor entirely, increasing overall exposure - only acceptable if paired with other compensating controls such as IP restrictions or a separate MFA solution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SiteGround Security is a WordPress plugin (CPE: cpe:2.3:a:siteground:siteground_security) that provides site-hardening features including two-factor authentication. CWE-290 (Authentication Bypass by Spoofing) describes flaws in which an attacker circumvents authentication by forging or spoofing identity tokens, session state, or verification responses rather than supplying valid credentials. In this instance, the plugin's 2FA verification logic permits an unauthenticated party to manipulate or spoof the second-factor validation step, bypassing it entirely. The CVSS AC:H rating suggests exploitation requires a specific condition to trigger - potentially a crafted request sequence, timing dependency, or session-state manipulation that causes the spoofed response to be accepted as valid.
Know when Siteground Security gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable login endpoint requires no credentials (PR:N) but elevated complexity to spoof 2FA state (AC:H); successful bypass yields full WordPress site compromise (C:H/I:H/A:H) within unchanged scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
Executive ViewAI
The SiteGround Security WordPress plugin (versions 1.6.6 and below) contains a high-severity authentication bypass flaw that allows unauthenticated attackers to circumvent two-factor authentication protections and establish fully authenticated WordPress sessions without valid credentials. Organizations relying on this plugin for access controls face immediate risk of unauthorized administrative access and potential data compromise. With no public exploit identified at time of analysis, prompt mitigation is critical to protect WordPress installations before threat actors develop weaponizable code.
No vendor-released patch identified at time of analysis. Implement these interim mitigations: deactivate the vulnerable plugin and deploy alternative 2FA solutions immediately; configure Web Application Firewall (WAF) rules to detect anomalous authentication attempts; enforce strict rate limiting on login endpoints and restrict administrative access to known IP ranges; enable continuous monitoring and alerting on authentication logs; implement mandatory password resets for all administrative users and conduct periodic access reviews.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Siteground Security
View allThe SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL qu
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to
Exploit-DB