CVE-2026-8903

Name of the Vulnerable Software and Affected Versions Two-factor authentication (formerly IP Vault) plugin for WordPress versions prior to 2.2

Description This issue involves Cross-Site Request Forgery, a flaw where an attacker tricks a victim into performing actions they did not intend to do. The problem occurs due to missing or incorrect nonce validation in the ipv save changes() function. Unauthenticated attackers can exploit this to modify firewall and two-factor authentication settings, such as the operating mode, request include/exclude rules, authentication slug, and log retention period, which could lead to the complete disabling of protection.

Recommendations Update the plugin to a version newer than 2.1. As a temporary mitigation, restrict access to the ipv save changes() function.