6.4
Medium
CVE-2026-12988 The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor…
Description
The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP 2FA 3.1 | earliest → < 3.1.1.2 | 3.1.1.2 |
Other CVEs of WP 2FA
The 6 CVEs of WP 2FA →
CVE-2026-108066
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's…
2.7
Low
CVE-2026-103514
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used,…
7.5
High
CVE-2026-15372
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported…
7.5
High
CVE-2025-12628
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass…
6.3
Medium