CVE-2026-123091

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Unknown	Vigilant	< 2.11.0

References

https://wpscan.com/vulnerability/df65184a-9223-42de-8b4d-53ff427a9874/

Timeline

Published: Nov 9, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1230927.5The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its incoming user s CVE-2026-1230945.4Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service CVE-2026-1230957.5mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unc CVE-2026-1230966.5anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to cr CVE-2026-12316.4The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `j CVE-2026-123107.5Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbir CVE-2026-123114.7Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox E CVE-2026-1231192.3The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding CVE-2026-123127.5Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbir CVE-2026-1231256.5The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some i CVE-2026-1231283.7The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users CVE-2026-1231295.3The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthent