{"affected":[{"defaultStatus":"unaffected","product":"Vigilant","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"2.11.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-123091","cwes":["CWE-287"],"description":"The Vigilant  WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/df65184a-9223-42de-8b4d-53ff427a9874/"}],"kev":null,"metrics":[],"modifiedAt":1794204028205,"publishedAt":1794204028205,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/df65184a-9223-42de-8b4d-53ff427a9874/"}],"remediation":[],"revision":"6474335eee05800f98b812fe10aca8219f5c67265d2dbffdace6354f9355c676","sources":[{"modifiedAt":1794204028205,"name":"CNA: WPScan","retrievedAt":1794208126119,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123091"}],"ssvc":null,"status":"published","title":"Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms","updatedAt":1794208126119}