Advanced IP Blocker Zero-Day Lets Attackers Steal Session Cookies to Bypass 2FA

The Advanced IP Blocker plugin for WordPress contains a critical authentication bypass vulnerability that enables unauthenticated attackers to take over sites. This flaw, tracked as CVE-2026-104732, affects all plugin versions up to and including 8.13.13 and carries a CVSS score of 9.8.

What happened

The vulnerability stems from a logic error in the `handle_login_action()` function within the Advanced IP Blocker plugin. According to the National Vulnerability Database, the function fails to perform server-side checks to verify that a user completed the initial password authentication step. This omission allows attackers to skip directly to the second step of the two-factor authentication process.

The flaw is compounded by an error branch that unconditionally generates fresh nonces for any unauthenticated caller. These nonces, specifically `advaipbl-2fa-interim-{user_id}` and `advaipbl-2fa-verify-{user_id}`, are computed against a fixed empty-session context. Consequently, they remain fully reusable across subsequent requests, removing the need for valid session state.

Attackers can exploit this by brute-forcing the 6-digit TOTP code associated with a known user ID. The system lacks attempt counters, account lockout mechanisms, or `wp_login_failed` logging for these requests. This allows unlimited guessing attempts without triggering standard security alerts or blocking the source IP address.

Successful brute-forcing results in the issuance of a fully authenticated session cookie via `wp_set_auth_cookie`. The attacker gains access to the account without ever supplying the correct password. This applies to any account with the plugin's 2FA feature enabled, including high-privilege administrator accounts, leading to complete site takeover.

Why it matters

For organizations using WordPress, this vulnerability undermines the security assumption that two-factor authentication protects against password theft. The absence of rate limiting on TOTP submissions makes automated attacks trivial and difficult to detect through standard monitoring.

The National Vulnerability Database rates this issue as Critical due to the ease of exploitation and the severity of the impact. A CVSS score of 9.8 indicates that the vulnerability requires no user interaction and results in full system compromise.

Business leaders should recognize that this flaw affects the authentication layer itself, not just data handling. Compromised administrator accounts can lead to data exfiltration, malware injection, or defacement. The lack of logging means that security teams may remain unaware of ongoing attacks until significant damage occurs.

The vulnerability is classified under CWE-287, which relates to improper authentication mechanisms. This highlights a fundamental design flaw in how the plugin manages state transitions during the login process. Organizations relying on this plugin for IP blocking and 2FA must assess their exposure immediately.

What to watch

• Monitor server logs for unusual spikes in requests to login endpoints associated with the Advanced IP Blocker plugin.
• Check for unauthorized changes to site content, user permissions, or installed plugins after potential compromise.
• Review access logs for repeated failed login attempts that do not trigger standard WordPress failure notifications.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: Advanced IP Blocker

• Audit your WordPress installations to identify if the Advanced IP Blocker plugin is installed and enabled.
• Verify the current version of the plugin against the affected range (up to 8.13.13).
• Once the vendor provides an update, apply it immediately to patch the authentication bypass.
• Consider temporarily disabling the plugin's 2FA feature if no patch is available and critical access is required.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Advanced IP Blocker are affected by CVE-2026-104732?

All versions of the Advanced IP Blocker plugin up to and including version 8.13.13 are vulnerable to this authentication bypass.

Can attackers exploit this flaw without knowing the user's password?

Yes, attackers can bypass the password requirement entirely by brute-forcing the 6-digit TOTP code and obtaining a valid session cookie.

Does the system log these failed authentication attempts?

No, the vulnerability allows brute-forcing without firing `wp_login_failed` events, meaning standard login failure logs will not record these attacks.