Junglewise Threat Intelligence

CVE-2026-8903: WordPress Two-factor authentication CSRF in ipv_save_changes

CVE-2026-8903 · Severity: medium · CVSS 4.3 · Published 2026-05-27

Vendors: Wordpress.

Executive brief

The Two-factor authentication (formerly IP Vault) plugin for WordPress, which provides security features like firewalls and login protection, contains a vulnerability that allows attackers to change its settings. By tricking a site administrator into clicking a malicious link, an attacker can modify or disable the plugin's security protections. This could lead to the removal of two-factor authentication requirements or the disabling of the site's firewall, leaving the website more vulnerable to further attacks.

Technical details

The Two-factor authentication (formerly IP Vault) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the 'ipv_save_changes' function. This vulnerability affects all versions up to and including 2.1. An unauthenticated attacker can exploit this by inducing a site administrator to perform an action, such as clicking a link, which triggers a forged request to the vulnerable function. Successful exploitation allows the attacker to modify critical plugin settings, including the firewall operating mode, authentication slugs, and log retention periods, effectively allowing them to disable the site's security protections.

Affected products

  • WordPress Two-factor authentication (formerly IP Vault) up to, and including, 2.1

Timeline

  • 2026-05-27: disclosed: Vulnerability published to the CVE list.
  • 2026-05-27: advisory: Wordfence published the vulnerability details.

References