CVE-2026-8903

Vulnerability

The Two-factor authentication (IP Vault) plugin for WordPress versions up to and including 2.1 is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the ipv_save_changes function [1]. This function handles saving of plugin settings including operating mode (soft/hard), request include/exclude rules, authentication slug, log retention period, and other options [2][3]. The vulnerability exists in all versions up to 2.1.

Exploitation

An unauthenticated attacker can craft a malicious request that modifies any of the plugin's settings. To exploit, the attacker must trick a logged-in site administrator into performing an action such as clicking a link or visiting a page that triggers the forged request. No authentication or prior access is required from the attacker beyond social engineering.

Impact

Successful exploitation allows the attacker to alter the plugin's firewall and two-factor authentication settings arbitrarily. For example, the attacker could switch the operating mode to "soft" (which only redirects unauthorized requests) or disable logging entirely, effectively weakening or disabling protection. The attacker could also change the authentication slug, potentially bypassing two-factor authentication. The impact is a loss of integrity and availability of the security controls, potentially exposing the site to further attacks.

Mitigation

The vendor has not released a patched version as of the publication date (2026-05-27). Users should monitor the plugin's update channel for a fix. As a workaround, administrators can implement additional CSRF protection mechanisms or restrict access to the plugin's settings page. The plugin is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog at this time.