CVE-2026-14291

Name of the Vulnerable Software and Affected Versions security-ninja-premium versions prior to 5.290

Description The security-ninja-premium WordPress plugin fails to verify the second authentication factor in a specific two-factor authentication code path. This allows an unauthenticated attacker who possesses a user's password to bypass the enforced two-factor authentication for any account, including those with administrator privileges, by avoiding the requirement for a one-time code. This issue specifically affects the two-factor module available only in the premium build.

Recommendations Update security-ninja-premium to version 5.290 or later.