Technical impact
The asVereinbase WordPress plugin fails to enforce authentication rules in versions before 1.1.8. It accepts an empty second factor value as a valid match, enabling any unauthenticated attacker to authenticate as any user, including an administrator. This flaw gives the attacker full control over the site’s data, configuration, and user accounts, and is classified under CWE-287: Improper Authentication.
Affected Systems
WordPress sites that have the asVereinbase plugin installed at a version earlier than 1.1.8. No vendor-specific data is available beyond the plugin name; any installation running the affected code is susceptible regardless of hosting environment.
Risk and Exploitability
The vulnerability can be exploited from any network location with access to the WordPress instance, as it does not require a valid password or a valid second factor. The CVSS score is 9.8, indicating critical severity. The EPSS score is < 1% and the issue is not listed in CISA’s KEV catalog, but the nature of the flaw (unauthenticated full‑flush access) implies a high risk of exploitation. Attackers can remotely trigger the bypass simply by making an HTTP request to the authentication endpoint, making mitigation a priority.
