# BotBlocker Security <= 1.7.7 - Unauthenticated Two-Factor Authentication Bypass

- **ID:** WPSEC-2026-2616
- **Plugin:** BotBlocker Security – Complete security platform (`botblocker-security`), https://wordpress.org/plugins/botblocker-security/
- **Affected versions:** from 1.6.9 before 1.7.8
- **Fixed in:** 1.7.8 (Update to 1.7.8 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/botblocker-security
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2616/

## Description

The BotBlocker Security plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions 1.6.9 up to, and including, 1.7.7. This is due to the plugin tracking the pending 2FA challenge in a single per-user '_2fa_pending' user meta flag instead of per login session. The flag was set only by the core 'login_redirect' filter and was deleted as soon as any session of the account completed 2FA. Without the flag, the session was treated as fully verified. This makes it possible for unauthenticated attackers who know the password of a user whose role requires 2FA to obtain a fully trusted session without a valid second factor. They can log in through a login path that does not apply the 'login_redirect' filter, or log in at the same time as the legitimate user and wait for that user to complete 2FA in their own session.

## References

- https://wpsec.com/vuln/WPSEC-2026-2616/
- https://plugins.svn.wordpress.org/botblocker-security/tags/1.7.8/
- https://wordpress.org/plugins/botblocker-security/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2616/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.