CVE-2026-110960— Auth Armor <= 1.0.3 - Unauthenticated Account Takeover
Quick assessment
Affected
Unknown Auth Armor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Auth Armor WordPress 插件在 1.0.3 及更早版本中，未对多个可供未登录用户访问的处理程序（handlers）实施身份验证要求。这一漏洞会泄露站点存储的 API 凭证，并使未经身份验证的攻击者能够重置管理员的注册状态，进而接管该管理员账户。
Possible ATT&CK Techniques 2 AI
T1078.003 · Local Accounts T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Auth Armor | ≤ 1.0.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110960
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Auth Armor <= 1.0.3 - Unauthenticated Account Takeover
Source: CVE Program / CVE List V5
Vulnerability Description
The Auth Armor WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Auth Armor | 0 ~ 1.0.3 | - |
|
II. Public POCs for CVE-2026-110960
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110960
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-11-15 · 12 CVEs total
| CVE-2026-127048 | Lazy Blocks < 3.0.0 - Unauthenticated RCE | |
| CVE-2026-124673 | Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Post Title Disclosure via For | |
| CVE-2026-114452 | Kadence Memberships 3.2.17 - 4.0.5 - Subscriber+ Stripe Client Secret Disclosure and Payme | |
| CVE-2026-124671 | Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date | |
| CVE-2026-123707 | WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content Disclosure | |
| CVE-2026-114451 | Kadence Memberships < 4.0.6 - Unauthenticated Table Collation Downgrade via 'rcp-action' P | |
| CVE-2026-110984 | RegistrationMagic < 6.1.0.4 - Admin+ SQLi via 'rm_fromdate' and 'rm_dateupto' Parameters | |
| CVE-2026-110989 | RegistrationMagic 5.2.3.1 - 6.1.0.3 - Unauthenticated Non-Admin User Profile Modification | |
| CVE-2026-110987 | RegistrationMagic < 6.1.0.4 - Reflected XSS via 'rm_tr' and 'rm_ur' Parameters | |
| CVE-2026-103361 | Payment Gateway via Valitor for WooCommerce < 1.9.41 - Unauthenticated Payment Bypass via | |
| CVE-2026-116559 | A2Reviews <= 1.2.3 - Unauthenticated Plugin Data Modification and Disclosure |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-127048
Lazy Blocks < 3.0.0 - Unauthenticated RCE -
CVE-2026-124673
Burst Statistics < 3.7.5 - Unauthenticated Draft and Private -
CVE-2026-114452
Kadence Memberships 3.2.17 - 4.0.5 - Subscriber+ Stripe Clie -
CVE-2026-124671
Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclos -
CVE-2026-123707
WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content