What is the CVSS score of CVE-2026-11883?

CVE-2026-11883 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Webauthn Provider For Two Factor are affected by CVE-2026-11883?

Organizations using the WebAuthn Provider for Two Factor WordPress plugin (versions before 2.5.6) face a critical weakness in their account security: attackers who obtain user passwords can now…. A patch is available.

Is there a public PoC exploit available for CVE-2026-11883?

Yes, a public proof-of-concept exploit is available for CVE-2026-11883. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-11883?

Within 24 hours: Identify all WordPress installations using the WebAuthn Provider for Two Factor plugin and document current version numbers on each instance. Within 7 days: Upgrade all affected installations to WebAuthn Provider for Two Factor plugin version 2.5.6 or later; validate functionality before deployment. Within 30 days: Review authentication logs from the previous 90 days for suspicious two-factor authentication bypass attempts or unauthorized account access; consider resetting passwords for administrative accounts.

Webauthn Provider For Two Factor CVE-2026-11883

EUVD-2026-40920 HIGH

2026-07-01 WPScan

GHSA-758r-7wwh-v6r7

WordPress Authentication Bypass Webauthn Provider For Two Factor Unknown

7.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 11:24 vuln.today

CVSS changed

Jul 01, 2026 - 11:22 NVD

7.2 (HIGH)

Patch available

Jul 01, 2026 - 08:01 EUVD

CVE Published

Jul 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 06:00 cve.org

HIGH 7.2

DescriptionCVE.org

The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request.

Articles & Coverage 1

News 16 New WordPress Vulnerabilities - 2 Critical, 14 High, 4 With POC Jul 02, 2026

AnalysisAI

Two-factor authentication bypass in the WebAuthn Provider for Two Factor WordPress plugin (all versions before 2.5.6) lets an attacker who already possesses a valid user's password defeat the WebAuthn second factor by submitting a malformed authentication response that the plugin fails to validate. This neutralizes the plugin's core protection, effectively reducing account security back to single-factor (password-only). Publicly available exploit code exists (reported by WPScan); there is no public exploit identified as being used in active attacks and the issue is not listed in CISA KEV.