WordPress Two-Factor Authentication Bypass in Premium Plugin

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-14291 is an authentication bypass vulnerability in the security-ninja-premium WordPress plugin that allows attackers to circumvent two-factor authentication (2FA) entirely. By exploiting a code path that fails to verify the second authentication factor, an unauthenticated attacker who possesses a user's password can complete login without providing the one-time code, successfully authenticating as any user—including administrators. This is particularly dangerous because it affects premium security software designed specifically to protect WordPress installations, undermining the trust organizations place in hardened authentication systems. Organizations running versions before 5.290 face immediate risk of account compromise and potential full site takeover through elevated administrative access.

Casky.ai's 283 matching skills map this vulnerability across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access), enabling detection of both the attack execution and its prerequisites. Practitioners using Casky would identify suspicious authentication patterns including: failed second-factor verification attempts that nonetheless result in successful session creation, login events from unexpected geographic locations or devices lacking corresponding 2FA challenges, and privilege escalation activities immediately following password-only authentication events. Claude's extended reasoning capabilities allow practitioners to correlate these signals across their logs—recognizing when an attacker has exploited the code path vulnerability versus standard brute-force attempts—and prioritize investigation of admin accounts where successful bypass indicates immediate compromise requiring emergency response.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14291.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-14291

Casky has 283 skills that investigate the attack patterns behind CVE-2026-14291. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn