Advanced Ip Blocker
Monthly
Unauthenticated attackers can bypass two-factor authentication and obtain a fully authenticated session for any 2FA-enabled account - including administrators - on WordPress sites running the Advanced IP Blocker plugin through version 8.13.13, without ever supplying a password. The plugin's step-2 handler fails to verify that step-1 password authentication was completed and leaks reusable interim and verify nonces to any unauthenticated caller, while the 6-digit TOTP comparison has no attempt counter, no account lockout, and does not fire wp_login_failed, so an attacker can brute-force up to roughly 10^6 codes for a known user_id and receive a session cookie via wp_set_auth_cookie, resulting in complete site takeover. No public exploit identified at time of analysis, and exploitation requires only that the targeted account has the plugin's own 2FA feature enabled and that the attacker knows its user_id (administrator accounts are commonly user_id 1).
Unauthenticated attackers can bypass two-factor authentication and obtain a fully authenticated session for any 2FA-enabled account - including administrators - on WordPress sites running the Advanced IP Blocker plugin through version 8.13.13, without ever supplying a password. The plugin's step-2 handler fails to verify that step-1 password authentication was completed and leaks reusable interim and verify nonces to any unauthenticated caller, while the 6-digit TOTP comparison has no attempt counter, no account lockout, and does not fire wp_login_failed, so an attacker can brute-force up to roughly 10^6 codes for a known user_id and receive a session cookie via wp_set_auth_cookie, resulting in complete site takeover. No public exploit identified at time of analysis, and exploitation requires only that the targeted account has the plugin's own 2FA feature enabled and that the attacker knows its user_id (administrator accounts are commonly user_id 1).