Adam Clinch

**Name of the Vulnerable Software and Affected Versions** security-ninja-premium versions prior to 5.290 **Description** The security-ninja-premium WordPress plugin fails to verify the second authentication factor in a specific two-factor authentication code path. This allows an unauthenticated attacker who possesses a user's password to bypass the enforced two-factor authentication for any account, including those with administrator privileges, by avoiding the requirement for a one-time code. This issue specifically affects the two-factor module available only in the premium build. **Recommendations** Update security-ninja-premium to version 5.290 or later.