EUVD-2026-43628
GHSA-ghqr-w463-c6wr
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Network attack requiring pre-compromised credentials (AC:H, PR:L); account takeover yields high confidentiality and integrity impact, not availability, correcting the provided vector's C:L/I:L/A:H miscalibration.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.
AnalysisAI
Account takeover in the WP 2FA WordPress plugin (all versions before 3.1.1.2) is achievable by any attacker who has obtained a valid user's credentials. The plugin fails to verify that the email address submitted during two-factor authentication enrollment belongs to the authenticated account (CWE-862: Missing Authorization), allowing the attacker to redirect the setup verification code to an attacker-controlled inbox and complete 2FA enrollment on behalf of the victim. A publicly available proof-of-concept exists per WPScan; this vulnerability is not currently listed in the CISA KEV catalog, but the combination of a PoC, medium-prevalence deployment, and account-takeover impact warrants prompt patching.
Technical ContextAI
WP 2FA is a WordPress plugin that adds multi-factor authentication flows to WordPress sites. During the 2FA setup/enrollment phase, the plugin sends a verification code to an email address supplied by the initiating user. The root cause is CWE-862 (Missing Authorization): the plugin performs no ownership check to confirm that the user-supplied email matches the WordPress account's registered address. This is a server-side input validation failure on a security-critical enrollment endpoint. The affected product is identified by CPE cpe:2.3:a:unknown:wp_2fa:*:*:*:*:*:*:*:*, covering all versions up to but not including 3.1.1.2. Because the flaw sits in the enrollment flow rather than the verification step, it bypasses the intent of 2FA entirely - the very mechanism meant to protect accounts becomes the vector for takeover.
RemediationAI
Update the WP 2FA WordPress plugin to version 3.1.1.2 or later, which introduces proper ownership verification of the email address supplied during 2FA enrollment. This is a vendor-released patch and the fix version is confirmed by EUVD-2026-43628. The WPScan advisory at https://wpscan.com/vulnerability/8aa6bf91-54ee-4326-a477-31f42284be22/ provides additional remediation context. As a compensating control before patching, site administrators should enforce strong, unique passwords and enable login anomaly detection to reduce the likelihood of credential compromise - the mandatory prerequisite for this exploit. Disabling new 2FA enrollments at the plugin level, if the feature allows it, would eliminate the attack surface entirely until a patch is applied, though this prevents legitimate users from enrolling. Sites using SSO or external identity providers that bypass WP 2FA enrollment are not exposed via this specific flow.
Two-factor authentication bypass in the WP 2FA WordPress plugin before 4.1.0 allows an attacker who possesses a valid us
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could b
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP 2FA w
Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.2.0. Rated medium severity (CVSS
The WP 2FA - Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in
The WP 2FA - Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Refere
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today