What’s Vulnerable › Vulnerabilities
CVE-2026-14291: Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-23 · updated 2026-07-23
- Weakness: CWE-287
Description
The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.
Affected products
- security-ninja-premium: before 5.290 — fixed in 5.290
How to fix
Upgrade to a fixed version: security-ninja-premium 5.290. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-14291 or the next vulnerability affects your stack