PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8903 youtag CVE debrief

A Cross-Site Request Forgery (CSRF) vulnerability in the Two-factor authentication (formerly IP Vault) WordPress plugin allows unauthenticated attackers to modify critical security settings. The flaw exists in the ipv_save_changes function due to missing or incorrect nonce validation across all versions up to and including 2.1. Successful exploitation requires social engineering a site administrator into clicking a malicious link, which could result in complete disabling of firewall and two-factor authentication protections. The vulnerability was disclosed on May 27, 2026 with a CVSS 3.1 score of 4.3 (Medium severity).

Vendor
youtag
Product
Two-factor authentication (formerly IP Vault)
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

WordPress site administrators using the Two-factor authentication (IP Vault) plugin; security teams managing WordPress deployments; managed WordPress hosting providers

Technical summary

The ipv_save_changes function in the Two-factor authentication (formerly IP Vault) WordPress plugin fails to properly validate nonces, allowing state-changing requests to be forged. Attackers can modify operating mode, request include/exclude rules, authentication slug, and log retention period. The attack vector is network-based with low attack complexity, requiring user interaction but no privileges. Impact is limited to integrity (low) with no confidentiality or availability impact per CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

Defensive priority

medium

Recommended defensive actions

  • Update the Two-factor authentication (IP Vault) plugin to version 2.2 or later immediately upon availability
  • Implement additional CSRF protection at the web application firewall level for WordPress administrative endpoints
  • Enable WordPress core nonce verification for all plugin settings modifications as a defense-in-depth measure
  • Review and audit plugin settings for unauthorized changes if the site has been active since before May 27, 2026
  • Consider implementing Content Security Policy (CSP) headers to mitigate impact of successful CSRF attacks
  • Educate site administrators about phishing risks and verify unexpected links before clicking
  • Monitor WordPress security advisories for this plugin to confirm patch availability

Evidence notes

Vulnerability confirmed via Wordfence security advisory and WordPress plugin repository source code analysis. CWE-352 (Cross-Site Request Forgery) identified as primary weakness. No known exploitation in the wild as of disclosure date.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8903 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8903

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8903 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8903

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.