CVE-2026-110960 in Auth Armor Plugin
Summary
by MITRE • 11/15/2026
The Auth Armor WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/15/2026
Auth Armor is a security-focused WordPress plugin designed to enhance website protection by implementing multi-factor authentication and other access control mechanisms for administrators and privileged users. The vulnerability identified in versions through 1.0.3 stems from insufficient authorization checks on several API endpoints exposed by the plugin. Specifically, these handlers are accessible without requiring any form of user authentication or session validation when accessed by logged-out visitors to the WordPress site. This architectural flaw allows unauthenticated actors to interact directly with sensitive administrative functions that should be restricted exclusively to authenticated users with appropriate privileges.
The technical nature of this vulnerability is classified as a Broken Access Control issue, aligning with CWE-284 in the Common Weakness Enumeration standard. The plugin fails to enforce proper access control policies on server-side handlers responsible for managing administrator enrollment and API credential storage. By bypassing authentication requirements, an attacker can retrieve sensitive data such as stored API keys or tokens that are used by the plugin to communicate with external security services or identity providers. This exposure of credentials represents a significant confidentiality breach, potentially allowing further exploitation if these secrets are compromised and reused in other contexts where they hold value.
Beyond credential leakage, the lack of authentication on enrollment reset handlers enables an unauthenticated attacker to perform administrative account takeover. By resetting the multi-factor authentication enrollment for an administrator account, the attacker effectively removes the secondary layer of security that Auth Armor provides. Once the enrollment is cleared, the attacker can attempt to log in as the administrator using only the primary password credentials. If the administrator has a weak or commonly used password, this action facilitates complete compromise of the WordPress administrative dashboard. This sequence aligns with ATT&CK technique T1078, Valid Accounts, specifically focusing on account manipulation and privilege escalation through bypassing multi-factor authentication controls.
The operational impact of this vulnerability is severe for any organization relying on Auth Armor to secure their WordPress infrastructure. The combination of credential leakage and administrative takeover can lead to full site compromise, including defacement, data exfiltration, malware injection, or the use of the compromised server as a pivot point for further network attacks. Since WordPress powers a significant portion of the web, such vulnerabilities pose systemic risks not only to individual sites but also to broader internet security if exploited at scale through automated scanning tools that target known vulnerable plugin versions.
Mitigation strategies must prioritize immediate remediation by updating the Auth Armor plugin to version 1.0.4 or later, where these authorization checks have been corrected to require proper authentication for all sensitive handlers. In environments where upgrading is not immediately feasible, administrators should consider disabling the affected endpoints if possible through web application firewall rules that block unauthenticated requests to specific API paths associated with the plugin. Additionally, enforcing strong password policies and monitoring login attempts can help detect unauthorized access attempts resulting from this vulnerability. Regular security audits of third-party plugins are essential to ensure they adhere to secure coding standards and do not expose sensitive administrative functions without adequate authentication controls.