EUVD-2026-89938
GHSA-354m-g9fm-q6gw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site with Two Factor plugin
-
ExploitSend crafted unthrottled requests
-
ExecutionTrigger uncontrolled resource consumption
-
ImpactDegrade site availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only network reachability to a WordPress site running the Two Factor plugin version 0.16.0 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are indicated. The primary limiting factor is the impact ceiling: availability impact is rated Low (A:L, not A:H), so exploitation degrades rather than fully disables the service, and confidentiality/integrity are unaffected. The exact feature or endpoint that lacks resource throttling is not specified in the available data. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, but the technical impact is confined to availability only (C:N/I:N) and rated Low (A:L), yielding the 5.3 base score. The Low availability impact (rather than A:H) implies the flaw causes partial or transient resource exhaustion - consistent with CWE-770 (Allocation of Resources Without Limits or Throttling) - rather than a full site takedown, so real-world risk is moderate at most. No EPSS score, KEV listing, or POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a genuine but lower-tier issue: the unauthenticated network vector raises exposure, yet the availability-only, Low-impact nature keeps it well short of a critical priority. The single limiting signal to verify is exactly how resource-limited the DoS is, since Patchstack's description is sparse and names no specific endpoint or parameter. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker repeatedly sends crafted requests to a WordPress site running the Two Factor plugin (<= 0.16.0), abusing an unthrottled operation to consume server resources and degrade availability. No authentication or user interaction is needed, but the impact is limited resource exhaustion rather than a complete outage. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated denial of service in the Two Factor WordPress plugin versions up to and including 0.16.0 allows remote attackers to degrade service availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates a network-reachable, low-complexity attack requiring no authentication or user interaction, but with only low availability impact and no effect on confidentiality or integrity (base score 5.3). No public exploit identified at time of analysis; the vulnerability is tracked as CWE-770 (Allocation of Resources Without Limits or Throttling).
RemediationAI
No vendor-released patch identified at time of analysis. Administrators should monitor the Patchstack advisory for an updated version. As a compensating control, disable the Two Factor plugin if the site can temporarily forgo two-factor authentication; this removes the attack surface but weakens login security until an alternative 2FA method is deployed. If the plugin must remain enabled, implement request rate limiting at the web server or reverse proxy (e.g., Nginx limit_req, Apache mod_ratelimit) or via a Web Application Firewall to throttle requests to WordPress endpoints, especially those related to authentication; this may affect legitimate users under high traffic and does not address the root cause. Additionally, restrict network access to the WordPress site to trusted IPs where feasible, but this is often impractical for public-facing sites.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Two Factor plugin for WordPress provides two-factor authentication. The vulnerability arises from a lack of resource throttling or rate limiting on a network-accessible endpoint, as categorized by CWE-770. The CPE cpe:2.3:a:wordpress.org:two_factor:*:*:*:*:*:*:*:* confirms the affected component is the WordPress.org-hosted plugin, and all versions up to 0.16.0 are impacted per the description. The exact endpoint or feature lacking limits is not specified, but the unauthenticated nature (PR:N) means any remote client can trigger the resource exhaustion without credentials or user action. According to the independent assessment, the impact is limited to availability (C:N/I:N) and rated Low (A:L), so exploitation degrades rather than fully disables the service.
Know when Two Factor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Unauthenticated network-reachable request with no user interaction (AV:N/AC:L/PR:N/UI:N); uncontrolled resource consumption causes partial availability loss only (A:L), no C/I impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB