CVE-2026-123091 in Vigilant Plugin
Summary
by MITRE • 11/09/2026
The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/09/2026
The vulnerability identified in versions of the Vigilant WordPress plugin prior to 2.11.0 represents a critical failure in authentication enforcement mechanisms, specifically categorized under CWE-306: Missing Authentication for Critical Function. While the plugin correctly implements two-factor authentication (2FA) on the standard wp-login.php endpoint, it fails to apply this security control to alternative login entry points within the WordPress ecosystem. This architectural oversight creates a significant bypass vector where an attacker possessing valid user credentials can circumvent the secondary verification step entirely by targeting non-standard login forms or endpoints that do not trigger the plugin's 2FA logic.
From a technical perspective, the flaw stems from insufficient input validation and lack of centralized authentication hooks across all potential access vectors. WordPress allows for multiple ways to initiate an authentication session, including custom form submissions, REST API calls, or third-party integrations. The Vigilant plugin appears to have hardcoded its 2FA enforcement exclusively around the default administrative login page rather than implementing a global hook that intercepts and validates credentials regardless of the entry point. Consequently, any application logic that accepts username and password pairs without invoking the specific function responsible for checking the second factor remains vulnerable. This is not merely a configuration error but a fundamental design flaw in how the security module integrates with the core authentication lifecycle.
The operational impact of this vulnerability is severe, as it effectively nullifies the primary benefit of two-factor authentication: defense against credential theft. If an attacker obtains user passwords through phishing, brute-force attacks, or data breaches from other services where users reuse credentials, they can immediately compromise the WordPress account without needing access to the user's second factor device, such as a mobile authenticator app or SMS token. This undermines the security posture of any organization relying on this plugin for compliance with standards requiring multi-factor authentication, potentially exposing sensitive site content, administrative functions, and stored data to unauthorized access.
In terms of industry mapping, this vulnerability aligns closely with MITRE ATT&CK technique T1078: Valid Accounts, specifically in the context of bypassing additional security controls. It also reflects weaknesses associated with CWE-287: Improper Authentication, where the system fails to properly verify identity during login processes for certain paths. The lack of consistent enforcement across all authentication endpoints is a common pitfall in plugin development that leaves systems exposed even when robust security measures are ostensibly installed and configured correctly by administrators who assume comprehensive coverage.
To mitigate this risk, immediate action must be taken by updating the Vigilant WordPress plugin to version 2.11.0 or later, where the developers have addressed these gaps by ensuring two-factor authentication is enforced uniformly across all login forms and endpoints. Until an update can be applied, administrators should consider disabling any custom login pages or alternative access methods that do not natively support the plugin's security checks. Additionally, implementing a Web Application Firewall (WAF) with rules designed to detect anomalous login patterns from non-standard IPs or user agents may provide a temporary layer of defense against automated attacks exploiting this bypass. Regular audits of authentication flows and adherence to secure coding standards like OWASP ASVS are recommended to prevent similar oversights in future development cycles, ensuring that security controls are applied holistically rather than selectively.