Wp 2Fa

The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.

Published: 2026-10-14T06:00:12.277Z
Updated: 2026-10-15T10:32:08.873Z

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.

Published: 2026-08-05T06:00:12.394Z
Updated: 2026-08-05T15:15:35.424Z

The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.

Published: 2026-07-14T06:00:02.858Z
Updated: 2026-07-14T12:24:36.125Z

The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them

Published: 2025-11-24T12:58:37.015Z
Updated: 2025-11-24T15:09:10.780Z

The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.

Published: 2022-10-10T00:00:00.000Z
Updated: 2024-08-03T00:53:00.501Z