2.7
Faible
CVE-2026-108066 The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's…
Description
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WP 2FA 4.2 | premières → < 4.2.0 | 4.2.0 |
Autres CVE de WP 2FA
Les 6 CVE de WP 2FA →
CVE-2026-103514
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used,…
7.5
Élevée
CVE-2026-15372
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported…
7.5
Élevée
CVE-2026-12988
The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor…
6.4
Moyenne
CVE-2025-12628
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass…
6.3
Moyenne