Advanced IP Blocker EUVD-2026-96039

Exploitation requires (1) the targeted account to have the Advanced IP Blocker plugin's own 2FA feature enabled, and (2) the attacker to know a valid user_id for that account (administrators are typically user_id 1, making discovery trivial). No password and no prior authentication are needed: the step-2 handler leaks reusable advaipbl-2fa-interim-{user_id} and advaipbl-2fa-verify-{user_id} nonces (computed against a fixed uid=0 empty-session context) to any unauthenticated caller. The only practical limiting factors are that 2FA must be active on the target account and that the attacker must brute-force the 6-digit TOTP (up to ~10^6 requests) - but this is unthrottled with no attempt counter, no account lockout, and no wp_login_failed firing, so the limit is negligible. All plugin versions up to and including 8.13.13 on any WordPress deployment are affected.

All signals that are present point to a genuine high-priority issue, though some decision inputs are missing. The NVD CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) is internally consistent with the description: the flaw is reachable over the network against an unauthenticated caller with no user interaction, and the outcome is full administrative account takeover (C:H/I:H/A:H). The description substantiates the PR:N claim concretely - the vulnerable handle_login_action() mints and leaks reusable nonces (computed against a fixed uid=0 context) to any unauthenticated requester, and the step-2 TOTP check is unthrottled with no lockout and no wp_login_failed event, so a 6-digit code (≤10^6 requests) is brute-forceable without the account password. No EPSS score, SSVC decision, KEV entry, or public POC was provided in the input: exploitation status is therefore 'no public exploit identified at time of analysis', and the absence of EPSS/SSVC means automatability and real-world exploitation volume cannot be quantified from this data. The one meaningful precondition that tempers raw 9.8 severity is that the target account must have the plugin's own 2FA feature enabled and the attacker must know a valid user_id - a realistic but non-universal condition (admin is commonly user_id 1). Net: treat as a high-priority patch target for any site running this plugin with its 2FA enabled; the low-complexity, unauthenticated, full-takeover profile outweighs the lack of a published exploit.

An unauthenticated attacker targets a WordPress site running Advanced IP Blocker with 2FA enabled on the administrator account (user_id 1). They POST directly to the step-2 TOTP handler, which leaks reusable interim and verify nonces, then brute-force the unthrottled 6-digit TOTP code until handle_login_action() issues a valid wp_set_auth_cookie session - gaining admin access without ever knowing the password. No public POC is identified at time of analysis, but the low attack complexity makes weaponization straightforward.