EUVD-2026-91934
GHSA-fh83-crgf-9w82
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H because the attacker must capture and replay a TOTP within its short window; PR:L because valid account credentials are a precondition; full C/I/A:H as 2FA bypass fully compromises the account.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.
AnalysisAI
TOTP replay in the WP 2FA WordPress plugin (versions before 4.1.0) allows an attacker who already knows an account's password and can capture a valid time-based one-time passcode within its ~30-second validity window to reuse that same code and complete login without ever knowing the second factor - including on administrator accounts. The defect (CWE-287, improper authentication) is that consumed codes are never invalidated, so replays succeed while the code is still live; this does not allow bypass from scratch, since it requires prior credential compromise plus real-time observation of a code via phishing, a proxy, MITM, or logging. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete, attacker-controlled-only-in-part prerequisites: (1) the attacker must already know the target account's password, and (2) the attacker must observe or intercept a valid time-based one-time passcode and replay it before its short validity window (typically ~30 seconds) expires - the plugin's failure to invalidate a consumed TOTP is the core defect. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional authentication-bypass flaw rather than a mass-exploitation emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the WP 2FA plugin to version 4.1.0 or later, which adds invalidation of consumed one-time passcodes; the fix is documented via the WPScan advisory at https://wpscan.com/vulnerability/e05aa5a3-cd04-428a-b6bb-0538ca1f6b4a/ and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-103514, and should be deployed along with a rotation of WordPress passwords for any account suspected of credential compromise. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations using the WP 2FA plugin and identify any version below 4.1.0; immediately update those sites to WP 2FA 4.1.0, or if an update cannot be applied, disable the plugin until patching is possible, and review authentication logs for suspicious administrator logins. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Two-factor authentication bypass in the WP 2FA WordPress plugin before 4.1.0 allows an attacker who possesses a valid us
Account takeover in the WP 2FA WordPress plugin (all versions before 3.1.1.2) is achievable by any attacker who has obta
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could b
Cross-site request forgery in the Melapress WP 2FA WordPress plugin, affecting all versions through 4.1.0, allows an att
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP 2FA w
Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.2.0. Rated medium severity (CVSS
The WP 2FA - Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in
The WP 2FA - Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Refere
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today