CVE-2026-104732: Advanced IP Blocker 2FA Step-Skip Authentication Bypass

Overview

Advanced IP Blocker is a WordPress plugin (vendor: inilerm) that adds IP-based brute-force protection and an optional two-factor (TOTP) login step on top of standard password authentication. CVE-2026-104732 is a critical authentication-bypass flaw in that 2FA flow: the plugin's handle_login_action() function processes step-2 TOTP submissions without ever verifying — via a transient, session marker, or equivalent — that the caller actually completed step-1 password authentication first. Combined with a nonce-generation bug and the complete absence of brute-force throttling, this lets a fully unauthenticated, remote attacker who merely knows a target's user_id obtain a valid, fully-authenticated session cookie for that account — including administrators. NVD published the record on 2026-10-10 with a CVSS 3.1 score of 9.8 (Critical); the advisory originates from Wordfence's threat-intelligence database and is also catalogued by VulDB and other aggregators.

Technical Details

How It Works

The plugin's login flow is meant to run in two steps: step 1 verifies the account password, and only after that succeeds does step 2 prompt for a 6-digit TOTP code. The bug is that handle_login_action() never checks whether step 1 actually happened before processing a step-2 submission for a given, attacker-supplied user_id — there is no transient, session marker, or any other server-side state tying step 2 to a prior successful password check.

Making this worse, an error branch inside handle_login_action() unconditionally mints a fresh advaipbl-2fa-interim-{user_id} nonce and returns it to the caller via a Location header — to any unauthenticated requester. display_2fa_login_form_step_2() then renders a matching advaipbl-2fa-verify-{user_id} nonce directly into the HTML it serves. Both nonces are computed against a fixed uid=0, empty-session context, so neither one is actually bound to a real, in-progress login — they are valid and reusable by anyone who simply knows the target's user_id, regardless of whether that person ever submitted a correct password.

From there, the only remaining control is the 6-digit TOTP code itself — and the plugin enforces no attempt counter, no account lockout, and never triggers the wp_login_failed action hook on a bad guess. That leaves an unauthenticated attacker free to brute-force all one million possible TOTP codes against the step-2 endpoint with no throttling at all. The first correct guess causes the plugin to call wp_set_auth_cookie(), issuing a fully authenticated session cookie identical to one from a legitimate password-plus-TOTP login.

Impact Assessment

Who Is At Risk

• Any WordPress site running Advanced IP Blocker ≤ 8.13.13 with its 2FA/TOTP login feature enabled on one or more accounts
• Sites where an attacker can determine or guess a target user_id — WordPress assigns low, sequential user IDs by default, and the first administrator account is frequently user_id=1
• Administrator and other high-privilege accounts specifically, since enabling 2FA on an account is what exposes it to this bypass — the feature intended to harden login is the attack surface itself

Attack Chain

1. Recon — Attacker identifies a target site running Advanced IP Blocker with 2FA enabled and obtains or guesses a valid user_id (commonly a low integer, with 1 often belonging to the first administrator).
2. Skip step 1 — Attacker sends a request directly to the step-2 TOTP handler (handle_login_action()) for that user_id, without ever submitting a password, since no session marker or transient ties step 2 to step 1.
3. Free nonce — The handler's error branch unconditionally issues a usable advaipbl-2fa-interim-{user_id} / advaipbl-2fa-verify-{user_id} nonce pair, computed from a fixed, empty uid=0 context rather than a real session.
4. Unthrottled brute force — Attacker submits 6-digit TOTP guesses against the step-2 endpoint; with no attempt counter, lockout, or wp_login_failed hook firing, the attempts run unchecked.
5. Session issued — A matching guess causes wp_set_auth_cookie() to hand the attacker a fully authenticated session cookie for the target account — never having supplied its password.
6. Takeover — If the compromised user_id belongs to an administrator, the attacker now has complete control of the WordPress site.

Mitigation

Immediate Actions

• Upgrade Advanced IP Blocker to the latest version available from the WordPress.org plugin repository as soon as a release addressing this issue is published; no specific fixed version number has been confirmed at the time of writing, so check the plugin's changelog before and after updating.
• Until a confirmed fix is installed, consider disabling the plugin's 2FA/TOTP login feature — paradoxically, enabling it is what exposes an account to this bypass, so turning it off removes the vulnerable code path (at the cost of losing the second factor).
• Where the 2FA feature must stay on, restrict access to wp-login.php and the plugin's login-action endpoints to a trusted network (VPN, IP allowlist, or a WAF rule blocking anonymous POSTs to the step-2 action) to shrink the pool of reachable attackers.
• Proactively rotate credentials for any administrator or privileged account that has 2FA enabled via this plugin, since a prior successful brute force would be indistinguishable from a normal login in standard logs.

Detection Opportunities

• Review web server and WAF logs for repeated POST requests to the plugin's step-2 TOTP action from a single IP or a rotating set of IPs, especially without a preceding successful password submission from the same source.
• The absence of wp_login_failed events despite many failed-looking login attempts is itself a signal here — the normal plugin flow should log failures, so large gaps are suspicious.
• Flag any successful login that is immediately preceded by a burst of rapid requests to the same step-2 endpoint for the same user_id.

Defence-in-Depth

• Enforce rate limiting and account lockout at the web server or WAF layer for all login-adjacent endpoints, independent of (and in addition to) the plugin's own broken throttling.
• Avoid low, easily guessable administrator user_id values where your tooling allows reassignment, and don't rely on user_id as a secret.
• Prefer a hardware security key or push-based approval over TOTP alone for administrator accounts, reducing exposure to any future brute-forceable short-code scheme.

Background

Advanced IP Blocker is positioned as a brute-force-mitigation plugin — it blocks abusive IPs and layers a 2FA step onto WordPress's native login — which makes this particular flaw notable: the exact feature meant to stop brute-force and credential-based attacks instead became the mechanism by which one succeeds. CVE-2026-104732 is a textbook example of a broken multi-step authentication state machine — a flow is only as strong as the server-side proof that each step was genuinely completed before the next is honored. When that proof is missing, as it was in handle_login_action(), a second factor meant to add security can be reached cold, turning a defense-in-depth control into a single point of unauthenticated brute-force exposure.

References

• NVD — CVE-2026-104732
• VulDB — CVE-2026-104732
• VulDB — Vulnerability Entry 416041
• Strix.ai — CVE-2026-104732