CVE-2026-110956: asVereinbase WordPress Plugin — Critical Authentication Bypass

Executive Summary

A critical authentication bypass has been published for the asVereinbase WordPress plugin. Tracked as CVE-2026-110956 with a CVSS score of 9.8, it affects all versions before 1.1.8.

Per the NVD description, the plugin does not require a valid password or a genuine second factor before authenticating a user, and treats an empty stored value as a match. An unauthenticated attacker can therefore log in as any user, including an administrator.

Vulnerability Overview

Root Cause

The login check compares supplied credentials against a stored value without confirming that the stored value is non-empty. When a user's stored value is empty, an empty supplied value matches, and the check passes. The same weak comparison applies to the second-factor step, so 2FA does not stop the bypass.

Impact

• Full account takeover of any user, including administrators
• On WordPress, administrator access commonly leads to code execution through plugin or theme editing and plugin upload
• Data theft, defacement, and persistence through new admin accounts

Remediation

1. Update asVereinbase to 1.1.8 or later.
2. If you cannot update, deactivate the plugin.
3. Audit user accounts for unexpected administrators and review recent login activity.
4. Rotate administrator passwords and invalidate active sessions after patching.
5. Check for newly installed plugins, modified theme files, and unfamiliar scheduled tasks.

Key Takeaways

1. CVSS 9.8: unauthenticated login as any user
2. Fixed in 1.1.8: update immediately
3. 2FA does not help because the second-factor check has the same empty-value flaw
4. Post-patch review matters, since exploitation leaves a valid-looking admin session

References

• NVD — CVE-2026-110956
• OWASP — Authentication Cheat Sheet