7.5
Élevée
CVE-2026-15372 The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported…
Description
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WP 2FA 4.1 | premières → < 4.1.0 | 4.1.0 |
Autres CVE de WP 2FA
Les 6 CVE de WP 2FA →
CVE-2026-108066
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's…
2.7
Faible
CVE-2026-103514
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used,…
7.5
Élevée
CVE-2026-12988
The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor…
6.4
Moyenne
CVE-2025-12628
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass…
6.3
Moyenne