{
 "id": "WPSEC-2026-2616",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2616/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2616/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2616/index.md",
 "title": "BotBlocker Security <= 1.7.7 - Unauthenticated Two-Factor Authentication Bypass",
 "description": "The BotBlocker Security plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions 1.6.9 up to, and including, 1.7.7. This is due to the plugin tracking the pending 2FA challenge in a single per-user '_2fa_pending' user meta flag instead of per login session. The flag was set only by the core 'login_redirect' filter and was deleted as soon as any session of the account completed 2FA. Without the flag, the session was treated as fully verified. This makes it possible for unauthenticated attackers who know the password of a user whose role requires 2FA to obtain a fully trusted session without a valid second factor. They can log in through a login path that does not apply the 'login_redirect' filter, or log in at the same time as the legitimate user and wait for that user to complete 2FA in their own session.",
 "plugin": {
  "slug": "botblocker-security",
  "name": "BotBlocker Security",
  "full_name": "BotBlocker Security – Complete security platform",
  "wordpress_org": "https://wordpress.org/plugins/botblocker-security/",
  "advisories_url": "https://wpsec.com/vuln/plugin/botblocker-security/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/botblocker-security"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.6.9",
    "from_inclusive": true,
    "to": "1.7.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.6.9 before 1.7.8"
  ]
 },
 "introduced_in": "1.6.9",
 "fixed_in": "1.7.8",
 "remediation": "Update to 1.7.8 or later.",
 "fix_released": "2026-11-04T19:18:08+00:00",
 "published": "2026-11-05T19:48:59+00:00",
 "updated": "2026-11-05T10:27:40.612500+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2616/",
  "https://plugins.svn.wordpress.org/botblocker-security/tags/1.7.8/",
  "https://wordpress.org/plugins/botblocker-security/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/botblocker-security",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}