Security Ninja Premium
Monthly
Two-factor authentication bypass in the Security Ninja Premium WordPress plugin (all versions before 5.290) lets a remote attacker who already knows a valid account password log in without supplying the one-time code, defeating enforced 2FA for any user including administrators. One of the plugin's two 2FA code paths never validates the second factor, so the protection can be silently skipped. Publicly available exploit code exists (published by WPScan) and a vendor patch is available; EPSS is low at 0.25% (17th percentile), indicating no evidence of widespread automated exploitation despite the POC.
Two-factor authentication bypass in the Security Ninja Premium WordPress plugin (all versions before 5.290) lets a remote attacker who already knows a valid account password log in without supplying the one-time code, defeating enforced 2FA for any user including administrators. One of the plugin's two 2FA code paths never validates the second factor, so the protection can be silently skipped. Publicly available exploit code exists (published by WPScan) and a vendor patch is available; EPSS is low at 0.25% (17th percentile), indicating no evidence of widespread automated exploitation despite the POC.