Description Insufficient state checks lead to a vector that allows to bypass 2FA checks. Remediation References CVE-2026-48897 Related Vulnerabilities WordPress Plugin Simple Banner Cross-Site Scripting (2.10.3) Craft CMS Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (CVE-2025-68454) Craft CMS CVE-2024-21622 Vulnerability (CVE-2024-21622) WordPress Plugin Connector for Gravity Forms and Google Sheets Cross-Site Scripting (1.1.0) WordPress Plugin WordPress Infinite Scroll-Ajax Load More Local File Inclusion (2.11.1) Severity High Classification CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Tags Missing Update Known Vulnerabilities CWE-287 CVE-2026-48897