Vulnerability record/PUBLISHED/Published Nov 15, 2026 06:00:06 UTC
CVE-2026-110960
The Auth Armor WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 15, 2026 06:00:06 UTC
PublishedNov 15, 2026 06:00:06 UTC
ReservedOct 15, 2026 09:33:04 UTC
Credits
- Muni Nitish Kumar Yaddala
- WPScan