---
id: CVE-2026-110956
title: >-
  asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA
  Validation
summary: >-
  The asVereinbase  WordPress plugin before 1.1.8 does not require a valid
  password or a genuine second factor before authenticating a user, treating an
  empty stored value as a match, so an unauthenticated attacker can log in as
  any user, …
severity: none
cwe:
  - CWE-287
product: asVereinbase
affected:
  - asVereinbase < 1.1.8
published: '2026-10-24'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T06:00:18.623Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110956'
references:
  - url: 'https://wpscan.com/vulnerability/95501052-9f20-4391-9171-184cd2e4a445/'
tags:
  - cve.org
ingestedAt: '2026-10-24T06:53:46.603Z'
---

## Overview

The asVereinbase  WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.

## Affected

- `asVereinbase < 1.1.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.