Loading story…
A high-severity vulnerability tracked as CVE-2026-62232 allows attackers to bypass two-factor authentication in Grav versions earlier than 2.0.4. The flaw is in the login plugin's regenerate2FASecret task, which during the pending TOTP challenge checks only whether a user exists and fails to verify authorization, enabling an attacker who already knows a victim's password to reset the victim's 2FA secret and complete login with an attacker-generated code.
The issue also lacks a required CSRF nonce on the secret-regeneration action, further weakening protections during authentication. Security advisories say the bug effectively reduces Grav's 2FA from password-plus-TOTP to password-only security for affected installations; the weakness is classified as CWE-862 and has been fixed in Grav 2.0.4.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A two-factor authentication bypass affecting Grav versions before 2.0.4 was fixed in Grav 2.0.4. The flaw in the login plugin's regenerate2FASecret task allowed an attacker with a victim's password to replace the victim's 2FA secret and complete login.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A mass disclosure detailed **11 vulnerabilities** in **Grav CMS** and the **`getgrav/grav-plugin-api`** package, with the most severe issues affecting the API plugin before **`1.0.13`** and Grav CMS before **`2.0.13`**. Multiple API endpoints failed to enforce API key scope caps or relied on bare `isSuperAdmin()` checks instead of scope-aware permission validation, allowing least-privilege or narrowly scoped keys to perform privileged actions. Reported impacts include creating unrestricted API keys (`CVE-2026-72826`), promoting users or invited accounts to super-admin (`CVE-2026-72828`, `CVE-2026-72829`, `CVE-2026-72833`), and disabling 2FA for non-super accounts without a TOTP code via `POST /api/v1/users/{user}/2fa/disable` (`CVE-2026-72822`). The disclosure also included several paths to **remote code execution**. In the API plugin, `CVE-2026-72830` allows attackers with `api.config.write` access to alter scheduler settings and inject commands through `scheduler.custom_jobs`, while `CVE-2026-72824` can enable Twig processing during page saves and lead to server-side template injection under certain settings. In core Grav CMS, `CVE-2026-72819` allows authenticated users to upload a malicious ZIP through Flex Objects and write PHP files to the web root, and `CVE-2026-72827` enables Twig injection through email-action parameters that can execute OS commands when forms are submitted. Advisories recommend upgrading to **Grav `2.0.13`** and **API plugin `1.0.13`**, rotating API keys, and auditing super-admin accounts, invitations, scheduler jobs, and 2FA settings; no active exploitation was reported at publication time.
Aug 19, 2026
A critical authentication bypass vulnerability, **CVE-2024-10924**, was disclosed and fixed in the WordPress plugin **Really Simple Security**, affecting the Free, Pro, and Pro Multisite editions in versions `9.0.0` through `9.1.1.1`. The flaw carries a **CVSS 9.8** rating and can allow an unauthenticated attacker to log in as any user, including an administrator, on sites where the plugin’s two-factor authentication feature is enabled. The issue was traced to improper error handling in the `check_login_and_get_user` function within the plugin’s two-factor authentication REST API. Defenders warned that roughly **4 million** websites could be exposed, making the bug a high-priority patching issue for WordPress operators. Site owners were urged to update immediately to **version 9.1.2 or later** to close the vulnerability.
Jul 24, 2026
Attackers are actively exploiting **CVE-2026-4020** in the RocketGenius **Gravity SMTP** WordPress plugin to extract sensitive configuration data and live email-service credentials from vulnerable sites. The flaw affects versions **2.1.4 and earlier** and stems from an unauthenticated REST API endpoint, `/wp-json/gravitysmtp/v1/tests/mock-data`, whose permission check always returns true; when queried with `page=gravitysmtp-settings`, it can return a detailed JSON system report containing environment data, API keys, secrets, and OAuth tokens tied to providers including **Amazon SES, Google, Mailjet, Resend, and Zoho**. The plugin is installed on roughly **100,000** WordPress sites, raising the risk of credential theft and abuse of legitimate outbound email infrastructure for spam, phishing, or follow-on compromise. **Wordfence** said it blocked more than **17 million** exploitation attempts, including a spike of over **4 million** in a single day, while **CrowdSec** observed at least **412** attacking IPs during earlier scanning and attack activity. RocketGenius released a fix in **Gravity SMTP 2.1.5**, and defenders are being urged to update immediately, rotate any potentially exposed credentials, and review logs for suspicious requests to the vulnerable endpoint.
Jun 29, 2026