CVE-2026-8903: WordPress Two-factor Plugin CSRF Vulnerability

CVE-2026-8903 Overview

CVE-2026-8903 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Two-factor authentication plugin (formerly IP Vault) for WordPress. The flaw exists in all versions up to and including 2.1. The root cause is missing or incorrect nonce validation on the ipv_save_changes function. Unauthenticated attackers can modify the plugin's firewall and two-factor authentication settings by tricking a site administrator into clicking a malicious link. Affected settings include the operating mode, request include and exclude rules, authentication slug, and log retention period. Successful exploitation can disable the plugin's protection entirely.

Critical Impact

Attackers can forge requests that disable two-factor authentication and firewall protections on affected WordPress sites, removing a key authentication safeguard.

Affected Products

• Two-factor authentication (formerly IP Vault) plugin for WordPress — all versions through 2.1
• WordPress installations with the ip-vault-wp-firewall plugin enabled
• Administrator accounts authenticated to vulnerable WordPress sites

Discovery Timeline

• 2026-05-27 - CVE-2026-8903 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-8903

Vulnerability Analysis

The vulnerability is classified as Cross-Site Request Forgery [CWE-352]. The plugin exposes administrative settings through the ipv_save_changes handler without verifying a valid WordPress nonce. WordPress nonces serve as anti-CSRF tokens that bind a request to a specific user session and action. Without that validation, the handler accepts any authenticated request that reaches it, regardless of origin.

An attacker crafts a malicious page or link containing a forged request targeting the plugin's settings endpoint. When an authenticated administrator visits the attacker-controlled content, the browser submits the request with the administrator's session cookies. The plugin processes the modified settings as if the administrator submitted them directly.

The impact is limited to integrity of plugin configuration. The attacker cannot directly read data or crash the host, but disabling two-factor authentication weakens the site's authentication posture and may enable follow-on credential attacks.

Root Cause

The ipv_save_changes function in includes/admin-settings.php processes administrative form submissions without calling wp_verify_nonce() or check_admin_referer(). This missing token check allows the handler to accept requests that did not originate from the plugin's own settings page.

Attack Vector

Exploitation requires user interaction. An attacker hosts a page containing a hidden form or image tag that submits a request to the vulnerable WordPress endpoint. The attacker then delivers the link through phishing, a comment, or a third-party site. When an authenticated administrator triggers the request, the browser attaches valid session cookies and the plugin applies the attacker's chosen configuration.

The vulnerability mechanism is documented in the plugin source at includes/admin-settings.php line 129 and ip-vault.php line 482. See the Wordfence Vulnerability Analysis and the WordPress IP Vault Code for technical references.

Detection Methods for CVE-2026-8903

Indicators of Compromise

• Unexpected changes to IP Vault plugin settings, including operating mode, include/exclude rules, authentication slug, or log retention period
• HTTP POST requests to the plugin settings endpoint with Referer headers pointing to external domains
• Administrator session activity originating from unusual IP addresses immediately preceding configuration changes
• Sudden disablement or weakening of two-factor authentication enforcement on the WordPress site

Detection Strategies

• Audit WordPress plugin configuration history and compare current IP Vault settings against a known-good baseline
• Inspect web server access logs for POST requests to admin-settings.php lacking same-origin Referer headers
• Monitor WordPress audit logs for setting changes that occur outside scheduled administrative sessions

Monitoring Recommendations

• Enable a WordPress activity log plugin to record administrative setting changes with user, timestamp, and source IP
• Alert on changes to the authentication slug or operating mode of the IP Vault plugin
• Review administrator browsing telemetry for visits to untrusted external sites prior to configuration changes

How to Mitigate CVE-2026-8903

Immediate Actions Required

• Update the Two-factor authentication (IP Vault) plugin to a version newer than 2.1 once the vendor releases a patch
• If no patched version is available, deactivate the plugin and use an alternative two-factor authentication solution
• Reset administrator sessions and verify current plugin configuration matches the intended security policy
• Train administrators to avoid clicking unsolicited links while authenticated to the WordPress admin console

Patch Information

No fixed version is identified in the published advisory at the time of CVE assignment. Monitor the Wordfence Vulnerability Analysis and the WordPress plugin repository for an updated release that adds nonce validation to the ipv_save_changes function.

Workarounds

• Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to limit exposure of authenticated sessions
• Use a web application firewall rule to require a same-origin Referer or Origin header on POST requests to the plugin settings endpoint
• Require administrators to use a dedicated browser profile for WordPress administration to reduce cross-site request exposure

# Example nginx rule to block cross-origin POSTs to the plugin settings endpoint
location ~* /wp-admin/admin\.php$ {
    if ($request_method = POST) {
        if ($http_origin !~* ^https?://(www\.)?example\.com$) {
            return 403;
        }
    }
}