Asvereinbase
Monthly
Authentication bypass in the asVereinbase WordPress plugin before 1.1.8 allows unauthenticated remote attackers to log in as any user, including an administrator, because the plugin accepts an empty stored password or second-factor value as a match. Affected are WordPress sites running the plugin at versions below 1.1.8; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no special configuration or user interaction is required. A public PoC reference exists but is not verified as working exploit code, and the EPSS score is low at 0.19% (8th percentile) even though the vuln.today decision label is act_now, so the severity and priority signals are split and should be read together.
Authentication bypass in the asVereinbase WordPress plugin before 1.1.8 allows unauthenticated remote attackers to log in as any user, including an administrator, because the plugin accepts an empty stored password or second-factor value as a match. Affected are WordPress sites running the plugin at versions below 1.1.8; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no special configuration or user interaction is required. A public PoC reference exists but is not verified as working exploit code, and the EPSS score is low at 0.19% (8th percentile) even though the vuln.today decision label is act_now, so the severity and priority signals are split and should be read together.