| CVE-2026-108066 |
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's…
|
2.7
Faible
|
14 oct. 2026 |
| CVE-2026-103514 |
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used,…
|
7.5
Élevée
|
3 oct. 2026 |
| CVE-2026-15372 |
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported…
|
7.5
Élevée
|
5 août 2026 |
| CVE-2026-12988 |
The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor…
|
6.4
Moyenne
|
14 juil. 2026 |
| CVE-2025-12628 |
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass…
|
6.3
Moyenne
|
24 nov. 2025 |
| CVE-2022-2891 |
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could…
|
Non notée
|
10 oct. 2022 |