CVE-2026-110956
asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation
Unknown asVereinbase
CVSS
9.8CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 24 Oct 2026FIRST EPSS
What fixes it
- 1.1.8asVereinbaseCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 2
1 outlet mention it. Reports are not confirmation; each links to its source.
- @thehackerwire.bsky.social: 🔴 CVE-2026-110956 - Critical (9.8) The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine se... https://www.thehackerwire.com/vulnerability/CBluesky: CVE posts, 24 Oct 2026
- @stackflag.bsky.social: CVE-2026-110956 - asvereinbase The asVereinbase add‑on for WordPress can let a stranger sign in as any user, even the site administrator, without needing a password or two‑step codBluesky: CVE posts, 24 Oct 2026
Description
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.
Text from CVE List
Affected versions 1
- asVereinbaseaffected: all versions before 1.1.8CVE List