WP 2FA CVE-2026-108066

Exploitation requires (1) a WordPress Multisite (network) installation - on single-site installs the behavior is not a security boundary crossing and is not exploitable as a vulnerability; (2) the attacker to already possess site-administrator privileges on at least one network site (PR:H); and (3) use of the plugin's 2FA-configuration removal feature against a target user account residing outside the attacker's own site. The limiting factors are substantial: no anonymous or low-privilege path exists, the attack only matters on Multisite, and impact is restricted to removing (not reading or forging) another user's 2FA configuration. There is no user interaction requirement (UI:N).

This is a genuinely low-priority issue and the signals are consistent in saying so. The CVSS 3.1 base score is 2.7 (vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N): the PR:H component confirms the attacker must already hold site-administrator privileges, and the only impact is I:L (no confidentiality or availability loss). EPSS reinforces this with a 0.22% exploitation probability at the 12th percentile - very low likelihood of broad opportunistic exploitation. The CVE is NOT in CISA KEV, so there is no public-exploit-code exists per WPScan (publicly available exploit), but POC availability is a distinct signal from active exploitation and does not change the low risk here because of the high privilege prerequisite and limited (integrity-only) impact. SSVC-style reasoning: exploitation is not automatable (requires an authenticated admin on a Multisite network targeting specific users), technical impact is partial, so a 'Track' rather than 'Act' disposition is appropriate. One nuance worth verifying: the CVSS vector is scored S:U (unchanged), yet the description explicitly says the flaw lets a site admin affect users on OTHER sites across a Multisite network - a cross-trust-boundary effect that some analysts would argue warrants S:C; the vendor score and this description are therefore in mild tension and the scope choice should be confirmed. On single-site installs this is not a vulnerability at all (admins already manage all users), so real-world risk is confined to WordPress Multisite deployments.

On a WordPress Multisite network, a user holding administrator rights on one site invokes the plugin's 2FA-removal functionality but targets a user account belonging to a different site that they are not permitted to edit, because WP 2FA performs no object-level capability check before deleting the 2FA configuration. The victim's two-factor protection is silently stripped, lowering their account to password-only authentication. Publicly available exploit/advisory detail exists via WPScan, but exploitation still requires pre-existing site-admin access on a Multisite install.