Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wp_2fa:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wp 2Fa (e0761586-6911-5da6-a0e9-fac9240fc6ee) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-15372 |
vulnerable | 2026-09-16 04:33:06.152456 |
WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.
Published: 2026-08-05T06:00:12.394Z
Updated: 2026-08-05T15:15:35.424Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12988 |
vulnerable | 2026-07-29 00:23:32.738706 |
WP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Binding
The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.
Published: 2026-07-14T06:00:02.858Z
Updated: 2026-07-14T12:24:36.125Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12628 |
vulnerable | 2026-06-08 07:04:30.561860 |
WP 2FA < 3.0.0 - Second Factor Bypass
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them
Published: 2025-11-24T12:58:37.015Z
Updated: 2025-11-24T15:09:10.780Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2891 |
vulnerable | 2026-06-08 05:43:36.671413 |
WP 2FA < 2.3.0 - Time-Based Side-Channel Attack
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.
Published: 2022-10-10T00:00:00.000Z
Updated: 2024-08-03T00:53:00.501Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.