The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Sg Security Plugin | — | Update sg-security plugin to version 1.2.6, or a newer patched version | May 15, 2025 | Apr 6, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub