CVE-2026-123091
Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user.
| Vendor | unknown |
| Product | vigilant |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown vigilant
Be the first to know when new high vulnerabilities affecting unknown vigilant are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Vigilant
0 < 2.11.0
References
Credits
Fernando Tellado WPScan