WordPress Two-factor Authentication Plugin CSRF Vulnerability (CVE-2026-8903) Advisory

Vulnerability Overview Vulnerability Name: Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update CVE ID: CVE-2026-8903 CVSS Score: 4.3 (Medium) Release Date: May 26, 2026 Last Updated: May 27, 2026 Researcher: afaan - SMKN 1 Bantul Affected Scope Software Type: Plugin Software Name: Two-factor authentication (formerly IP Vault) Affected Versions: <= 2.1 Vulnerability Type: Cross-Site Request Forgery (CSRF) Remediation Patch Status: No known patch available Recommendations: Review vulnerability details thoroughly and implement mitigation measures based on your organization's risk tolerance. It may be necessary to uninstall the affected software and seek alternatives. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Wordfence Intelligence: Provides free personal and commercial API access, as well as the latest WordPress vulnerability database. Support: Business hours are 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays). 24/7 response for premium support clients with a 1-hour response time. Footer Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Protection: Do Not Sell or Share My Personal Information Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Email: Email Other Links Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscribe Subscribe: Subscribe to news and updates from experienced security professionals. Email: you@example.com Agreement to Terms: By checking this box I agree to the terms of service and privacy policy. Register Register: SIGN UP Other Cherubic: Cherubic --- Vulnerability Details Vulnerability Description: The Two-factor authentication (formerly IP Vault) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to 2.1. Due to missing or incorrect nonce validation in the function, unauthorized attackers can modify the plugin's firewall and two-factor authentication settings, including operation mode, request include/exclude rules, plugin slug, and log retention period, thereby completely disabling protection. By forging requests, attackers can trick site administrators into clicking malicious links. Recent Vulnerabilities IP Vault - WP Firewall <= 1.1 - IP Address Spoofing to Protection Mechanism Bypass - CVE ID: CVE-2022-4536 - CVSS Score: 5.3 - Researcher: rezaauty - Date: August 30, 2024 IP Vault - WP Firewall <= 2.0 - Authenticated (Admin) Stored Cross-Site Scripting - CVE ID: CVE-2022-47171 - CVSS Score: 4.4 - Researcher: rezaauty - Date: February 2, 2023 More Vulnerabilities View: VIEW MORE VULNERABILITIES IN THIS SOFTWARE PACKAGE Disclaimer Copyright: This record contains copyrighted material. License: Defiant Inc. grants a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copies must contain this vulnerability record and Defiant's copyright notice and license. MITRE Corporation: 1999-2026 The MITRE Corporation grants a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copies must contain MITRE's copyright notice and license. Feedback Feedback: Have information to add or found an error? Contact wf-support@wordfence.com so we can make appropriate adjustments. Additional Information Wordfence Intelligence: Provides free personal and commercial API access, as well as the latest WordPress vulnerability database. Support: Business hours are 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays). 24/7 response for premium support clients with a 1-hour response time. Footer Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Protection: Do Not Sell or Share My Personal Information Social Media Facebook: Facebook Twitter: Twitter LinkedIn: LinkedIn Email: Email Other Links Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Fo

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Two-factor Authentication Plugin CSRF Vulnerability (CVE-2026-8903) Advisory

More from this source