CVE-2026-14291
High
Description
The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSecurity-ninja-premium
PublishedJul 23, 2026
First seenJul 23, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- security-ninja-premium5.290 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| security-ninja-premium | v < 5.290 | 5.290 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.