The asVereinbase WordPress plugin fails to enforce authentication rules in versions before 1.1.8. It accepts an empty second factor value as a valid match, enabling any unauthenticated attacker to authenticate as any user, including an administrator. This flaw gives the attacker full control over the site’s data, configuration, and user accounts, and is classified under CWE-287: Improper Authentication.

WordPress sites that have the asVereinbase plugin installed at a version earlier than 1.1.8. No vendor-specific data is available beyond the plugin name; any installation running the affected code is susceptible regardless of hosting environment.

The vulnerability can be exploited from any network location with access to the WordPress instance, as it does not require a valid password or a valid second factor. Although an EPSS score is unavailable and the issue is not listed in CISA’s KEV catalog, the nature of the flaw (unauthenticated full‑flush access) implies a high risk of exploitation. Attackers can remotely trigger the bypass simply by making an HTTP request to the authentication endpoint, making mitigation a priority.