6.3
Medium
CVE-2025-12628 The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass…
Description
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP 2FA 3.0 | earliest → < 3.0.0 | 3.0.0 |
Other CVEs of WP 2FA
The 6 CVEs of WP 2FA →
CVE-2026-108066
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's…
2.7
Low
CVE-2026-103514
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used,…
7.5
High
CVE-2026-15372
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported…
7.5
High
CVE-2026-12988
The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor…
6.4
Medium