WP 2FA CVE-2026-12988

Exploitation requires that the attacker has already obtained valid credentials - username and password - for the target WordPress account; this is the hard prerequisite reflected in CVSS PR:L and AC:H. The target WordPress site must have the WP 2FA plugin installed and active at a version prior to 3.1.1.2. The attack window is specifically the 2FA enrollment or re-enrollment phase: if the victim has already completed enrollment with their legitimate email and the plugin does not permit re-enrollment without additional verification, the attacker may need to trigger a reset or change flow. No special server configuration beyond the plugin's presence is required - the flaw is in default plugin behavior. Limiting factors include: the mandatory credential pre-compromise step, which requires a separate initial attack; the plugin being actively installed and in use on the target site; and the attacker's ability to initiate an enrollment session before the legitimate user detects unauthorized login.

The NVD-assigned CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, score 6.4) correctly captures the network attack surface and low-privilege prerequisite but appears miscalibrated on impact: A:H (high availability impact) is not well-supported by the description, while C:L and I:L understate the effective account takeover, which grants the attacker full control of the victim's WordPress account including its content, settings, and identity. AC:H reflects the realistic prerequisite of credential pre-acquisition, which meaningfully limits exploitation - an attacker who cannot first compromise a password cannot exploit this flaw at all. A publicly available PoC exists (confirmed by WPScan), elevating urgency above what a 6.4 score alone suggests. The vulnerability is not listed in CISA KEV, and EPSS data was not provided in the input, so exploitation probability cannot be quantified. For sites with shared or reused passwords, credential-stuffing campaigns, or prior breach exposure, the effective risk is considerably higher than the CVSS base score implies.

An attacker obtains the username and password for a WordPress account through credential stuffing, phishing, or a third-party data breach. They log in as the victim user, navigate to the 2FA setup flow provided by the WP 2FA plugin, and supply an attacker-controlled email address in place of the victim's real address. The plugin dispatches the enrollment verification code to the attacker's inbox; the attacker completes 2FA setup, binding the account's second factor to their own device, and achieves full account takeover. A publicly available PoC demonstrates this flow.