Unknown WP 2FA vulnerabilities
6 vulnerabilities
Known vulnerabilities in Unknown WP 2FA, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-108066unknownwp 2fa
EPSS score0.33%
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.CVE-2025-12628unknownwp 2fa+1EPSS score0.21%
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing themCVE-2022-2891unknownwp 2fa+2EPSS score0.95%
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.CVE-2026-103514unknownwp 2fa+1EPSS score0.30%
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.CVE-2026-15372unknownwp 2fa+1EPSS score0.52%
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.CVE-2026-12988unknownwp 2fa+1EPSS score0.28%
The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.