CVE-2026-104732: Bypass Autentikasi Advanced IP Blocker

CVE ID	CVE-2026-104732
Severity	CRITICAL — CVSS CVSS V3.1 9.8
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-287 CWE-287 Improper Authentication
Produk	inilerm / Advanced IP Blocker — 0 (affected)
Dipublikasikan	2026-10-10

Ringkasan Cepat

• CVE-2026-104732 adalah bypass autentikasi kritis 9.8 pada plugin WordPress Advanced IP Blocker hingga versi 8.13.13.
• Kerentanan terjadi karena handler login 2FA tidak memverifikasi bahwa peminta sudah menyelesaikan autentikasi password step-1 sebelum memproses TOTP step-2.
• Penyerang tanpa autentikasi dapat melewati 2FA akun mana pun, termasuk administrator, dan berpotensi mengambil alih situs; pembaruan atau nonaktifkan plugin menjadi prioritas.

Ringkasan Kerentanan

CVE-2026-104732 adalah kerentanan Authentication Bypass pada plugin WordPress Advanced IP Blocker dari vendor inilerm. Judul CNA menyebut Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler. Deskripsi resmi menyatakan semua versi hingga dan termasuk 8.13.13 terdampak.

Penyebab utamanya, handle_login_action() tidak melakukan pemeriksaan sisi server—melalui transient, penanda sesi, atau mekanisme setara—bahwa peminta telah menyelesaikan autentikasi password step-1 sebelum memproses pengiriman TOTP step-2 untuk user_id yang dikirim via POST. Selain itu, cabang error dalam fungsi tersebut tanpa syarat membuat nonce baru advaipbl-2fa-interim-{user_id} dan mengirimkannya dalam header Location kepada pemanggil tanpa autentikasi, lalu display_2fa_login_form_step_2() merender nonce valid advaipbl-2fa-verify-{user_id} dalam HTML. Kedua nonce dihitung terhadap konteks sesi kosong tetap uid=0 sehingga dapat digunakan ulang oleh penyerang pada permintaan berikutnya.

Severity resmi: CRITICAL 9.8 dengan vektor CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H dan CWE-287 (Improper Authentication). Tanggal publikasi: 2026-10-10T03:26:45.330Z.

Dampak Teknis

Karena tidak ada pengikatan step-1, penyerang tanpa autentikasi dapat memproses TOTP step-2 untuk akun yang fitur 2FA-nya aktif. Deskripsi resmi menyebut penyerang dapat mem-brute-force kode TOTP 6 digit secara tidak terbatas: tidak ada penghitung percobaan, tidak ada penguncian akun, dan tidak ada wp_login_failed yang dipicu. Setelah kode cocok, sesi terautentikasi penuh diterima melalui wp_set_auth_cookie tanpa pernah memasok password akun.

Dampaknya adalah complete site takeover, termasuk untuk akun administrator. Vektor CVSS menunjukkan dampak tinggi pada kerahasiaan, integritas, dan ketersediaan (C:H/I:H/A:H), dengan kondisi akses jaringan (AV:N), kompleksitas rendah (AC:L), tanpa privilese (PR:N), dan tanpa interaksi pengguna (UI:N). Eksploitasi hanya membutuhkan user_id yang diketahui untuk akun yang mengaktifkan fitur 2FA plugin.

Produk Terdampak

Produk yang terdampak adalah plugin WordPress Advanced IP Blocker dari vendor inilerm. Berdasarkan deskripsi resmi CVE, kerentanan memengaruhi semua versi hingga dan termasuk 8.13.13. Judul CNA secara eksplisit menyebut Advanced IP Blocker <= 8.13.13.

Data produk pada CVE mencantumkan vendor inilerm dan produk Advanced IP Blocker. Referensi yang tersedia mencakup advisory Wordfence dan tautan kode plugin di WordPress Trac untuk versi 8.13.13, termasuk berkas class-advaipbl-main.php dan class-advaipbl-2fa-manager.php.

Konteks dan Prioritas Pertahanan

Kerentanan ini menyoroti pentingnya verifikasi state di sisi server pada alur autentikasi multi-langkah. 2FA seharusnya menambah lapisan keamanan, tetapi jika langkah kedua tidak terikat pada langkah pertama, lapisan tersebut dapat dilewati. Karena plugin ini menangani pemblokiran IP dan alur 2FA, kompromi pada akun administrator dapat membuka jalan bagi perubahan konfigurasi, penonaktifan kontrol keamanan, dan pengambilalihan situs.

Prioritas perbaikan bersifat tinggi: perbarui plugin ke versi yang lebih baru dari 8.13.13 jika vendor menyediakan patch, atau nonaktifkan plugin sementara. Organisasi juga perlu memantau log autentikasi, meninjau sesi aktif, dan memastikan tidak ada akun atau perubahan tidak sah setelah paparan. Referensi resmi: advisory Wordfence untuk CVE-2026-104732 dan tautan kode WordPress Trac versi 8.13.13.

Mitigasi dan Perbaikan

• Perbarui Advanced IP Blocker ke versi yang lebih baru dari 8.13.13 segera setelah vendor merilis patch; karena deskripsi resmi menyebut semua versi sampai 8.13.13 terdampak, versi 8.13.13 atau lebih lama tidak aman.
• Jika patch belum tersedia atau tidak dapat segera diterapkan, nonaktifkan plugin Advanced IP Blocker sementara, terutama pada situs yang mengaktifkan fitur 2FA plugin.
• Terapkan mitigasi virtual melalui WAF atau penyedia keamanan yang mampu memblokir upaya bypass autentikasi pada endpoint login/2FA plugin, sampai patch terpasang.
• Audit akun administrator dan pengguna dengan 2FA aktif; ganti password, cabut semua sesi aktif, dan tinjau perubahan pengguna, role, serta konfigurasi mencurigakan.
• Pantau log akses dan autentikasi untuk anomali terkait login, pembuatan sesi, dan permintaan berulang ke handler 2FA; batasi akses administratif sesuai prinsip least privilege.

Referensi Resmi

• CVE-2026-104732 — CVE Program (cve.org)
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d080845b-6814-4b10-a3ab-1f5aa1d09132?source=cve
• https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L6875
• https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L6912
• https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L7022
• https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-2fa-manager.php#L71
• https://plugins.trac.wordpress.org/browser/advanced-ip-blocker/tags/8.13.13/includes/class-advaipbl-main.php#L519

Artikel ini disusun dari data publik CVE Program (cve.org). Selalu verifikasi patch resmi dari vendor sebelum menerapkan perubahan.

Pertanyaan yang Sering Diajukan (FAQ)

Apa itu CVE-2026-104732?

CVE-2026-104732 adalah CVE untuk kerentanan Authentication Bypass pada plugin WordPress Advanced IP Blocker. Judul CNA menyebut Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler.

Apa akar masalahnya?

Akar masalahnya adalah handle_login_action() tidak memiliki pemeriksaan sisi server berupa transient, penanda sesi, atau setara yang memastikan peminta sudah menyelesaikan autentikasi password step-1 sebelum memproses TOTP step-2. Nonce interim dan verify juga dihitung pada konteks uid=0 sehingga dapat digunakan ulang.

Siapa yang berisiko?

Situs WordPress yang memakai plugin Advanced IP Blocker versi hingga dan termasuk 8.13.13, khususnya jika fitur 2FA plugin aktif. Akun apa pun dengan 2FA aktif, termasuk administrator, dapat menjadi sasaran jika user_id diketahui.

Apakah penyerang memerlukan password akun?

Tidak. Deskripsi resmi menyatakan eksploitasi tidak mengharuskan penyerang memasok password akun; penyerang dapat menerima cookie sesi terautentikasi setelah melewati langkah TOTP. Eksploitasi hanya membutuhkan user_id yang diketahui untuk akun dengan 2FA plugin aktif.

Apakah sudah ada patch?

Data CVE yang disediakan tidak menyebut nomor versi patch. Karena semua versi hingga 8.13.13 disebut terdampak, periksa advisory vendor dan Wordfence untuk versi perbaikan; jika tersedia, perbarui ke versi setelah 8.13.13.

Apa langkah pertama jika tidak bisa segera update?

Nonaktifkan plugin Advanced IP Blocker sementara, terapkan mitigasi virtual jika tersedia, lalu audit akun dan sesi. Setelah patch tersedia, perbarui dan tinjau kembali log untuk aktivitas mencurigakan.

English Version — CVE-2026-104732: Advanced IP Blocker Authentication Bypass

Quick Summary

• CVE-2026-104732 is a critical 9.8 authentication bypass in the WordPress plugin Advanced IP Blocker up to version 8.13.13.
• The vulnerability occurs because the 2FA login handler does not verify that the requester has completed step-1 password authentication before processing step-2 TOTP.
• Unauthenticated attackers can bypass 2FA for any account, including administrator, and potentially take over the site; updating or disabling the plugin is a priority.

Vulnerability Summary

CVE-2026-104732 is an Authentication Bypass vulnerability in the WordPress plugin Advanced IP Blocker from vendor inilerm. The CNA title states Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler. The official description states that all versions up to and including 8.13.13 are affected.

The main cause is that handle_login_action() does not perform a server-side check—through a transient, session marker, or equivalent mechanism—that the requester has completed step-1 password authentication before processing the step-2 TOTP submission for the user_id sent via POST. In addition, the error branch in that function unconditionally creates a new nonce advaipbl-2fa-interim-{user_id} and sends it in the Location header to the unauthenticated caller, after which display_2fa_login_form_step_2() renders a valid nonce advaipbl-2fa-verify-{user_id} in the HTML. Both nonces are computed against a fixed empty session context uid=0, so they can be reused by an attacker in subsequent requests.

Official severity: CRITICAL 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and CWE-287 (Improper Authentication). Publication date: 2026-10-10T03:26:45.330Z.

Technical Impact

Because there is no step-1 binding, an unauthenticated attacker can process step-2 TOTP for accounts that have the 2FA feature enabled. The official description states that an attacker can brute-force the 6-digit TOTP code without limit: there is no attempt counter, no account lockout, and no wp_login_failed triggered. Once the code matches, a fully authenticated session is granted via wp_set_auth_cookie without ever supplying the account password.

The impact is complete site takeover, including for administrator accounts. The CVSS vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H), with network access conditions (AV:N), low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N). Exploitation only requires a known user_id for an account that has the plugin's 2FA feature enabled.

Affected Products

The affected product is the WordPress plugin Advanced IP Blocker from vendor inilerm. Based on the official CVE description, the vulnerability affects all versions up to and including 8.13.13. The CNA title explicitly states Advanced IP Blocker <= 8.13.13.

The product data in the CVE lists vendor inilerm and product Advanced IP Blocker. Available references include the Wordfence advisory and the plugin code link in WordPress Trac for version 8.13.13, including the files class-advaipbl-main.php and class-advaipbl-2fa-manager.php.

Context and Defense Priorities

This vulnerability highlights the importance of server-side state verification in multi-step authentication flows. 2FA is supposed to add a security layer, but if the second step is not bound to the first step, that layer can be bypassed. Because this plugin handles IP blocking and the 2FA flow, compromise of an administrator account can pave the way for configuration changes, disabling of security controls, and site takeover.

Remediation priority is high: update the plugin to a version newer than 8.13.13 if the vendor provides a patch, or temporarily disable the plugin. Organizations should also monitor authentication logs, review active sessions, and ensure there are no unauthorized accounts or changes after exposure. Official references: the Wordfence advisory for CVE-2026-104732 and the WordPress Trac code link for version 8.13.13.

Mitigation

• Update Advanced IP Blocker to a version newer than 8.13.13 as soon as the vendor releases a patch; because the official description states that all versions through 8.13.13 are affected, version 8.13.13 or earlier is not safe.
• If a patch is not yet available or cannot be applied immediately, temporarily disable the Advanced IP Blocker plugin, especially on sites that have the plugin's 2FA feature enabled.
• Apply virtual mitigation through a WAF or security provider capable of blocking authentication bypass attempts on the plugin's login/2FA endpoints until the patch is installed.
• Audit administrator accounts and users with 2FA enabled; change passwords, revoke all active sessions, and review suspicious user, role, and configuration changes.
• Monitor access and authentication logs for anomalies related to login, session creation, and repeated requests to the 2FA handler; restrict administrative access according to the principle of least privilege.

FAQ (English)

What is CVE-2026-104732?

CVE-2026-104732 is the CVE for an Authentication Bypass vulnerability in the WordPress plugin Advanced IP Blocker. The CNA title states Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler.

What is the root cause?

The root cause is that handle_login_action() lacks a server-side check such as a transient, session marker, or equivalent that ensures the requester has completed step-1 password authentication before processing step-2 TOTP. The interim and verify nonces are also computed in the uid=0 context, so they can be reused.

Who is at risk?

WordPress sites using the Advanced IP Blocker plugin version up to and including 8.13.13, especially if the plugin's 2FA feature is enabled. Any account with 2FA enabled, including administrator, can be targeted if the user_id is known.

Does the attacker need the account password?

No. The official description states that exploitation does not require the attacker to supply the account password; the attacker can receive an authenticated session cookie after bypassing the TOTP step. Exploitation only requires a known user_id for an account with the plugin's 2FA enabled.

Is there a patch?

The provided CVE data does not mention a patch version number. Because all versions through 8.13.13 are stated as affected, check the vendor advisory and Wordfence for a fixed version; if available, update to a version after 8.13.13.

What is the first step if you cannot update immediately?

Temporarily disable the Advanced IP Blocker plugin, apply virtual mitigation if available, then audit accounts and sessions. Once a patch is available, update and review the logs again for suspicious activity.