EUVD-2026-53119
GHSA-r795-xx32-3hg7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects the prerequisite of possessing valid target credentials; full admin account takeover warrants I:H and A:H beyond the NVD-assigned C:H only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.
AnalysisAI
Two-factor authentication bypass in the WP 2FA WordPress plugin before 4.1.0 allows an attacker who possesses a valid user password to completely skip the second authentication factor and gain full account access, including administrator-level accounts. The plugin presents the 2FA challenge but fails to server-side validate the submitted factor for any of its supported methods, rendering 2FA protections entirely ineffective. A publicly available exploit exists (sourced from WPScan), though EPSS sits at 0.19% (9th percentile), indicating limited observed exploitation activity at time of analysis despite the public proof-of-concept.
Technical ContextAI
WP 2FA is a WordPress plugin that adds multi-factor authentication to WordPress sites, supporting multiple second-factor methods (TOTP, email OTP, etc.). The root cause is CWE-287 (Improper Authentication): the plugin correctly prompts the user for a second factor at login but the server-side code path responsible for validating the submitted token is absent, incomplete, or bypassable for the chosen method. Because WordPress authentication flows route through plugin hooks, a flaw in second-factor verification logic means the plugin grants session authentication without confirming the factor. Affected products per CPE are cpe:2.3:a:unknown:wp_2fa:*:*:*:*:*:*:*:* covering all versions prior to 4.1.0. The NVD entry is cross-referenced as EUVD-2026-53119.
RemediationAI
The primary fix is to upgrade the WP 2FA plugin to version 4.1.0 or later, which resolves the missing second-factor validation. Plugin updates can be applied via the WordPress admin dashboard under Plugins > Installed Plugins > WP 2FA > Update, or via WP-CLI using 'wp plugin update wp-2fa'. The vendor advisory and exploit reference is at https://wpscan.com/vulnerability/a8d697c9-6de4-4a28-be9e-7d42abcb6c7e/. If immediate patching is not possible, a compensating control is to deactivate the WP 2FA plugin entirely until the patch is applied - note this removes 2FA protections completely, so it should be accompanied by enforcing strong unique passwords and restricting wp-login.php access by IP allowlist or WAF rule to reduce exposure from credential stuffing. Disabling the plugin is preferable to leaving a false sense of 2FA security in place.
Account takeover in the WP 2FA WordPress plugin (all versions before 3.1.1.2) is achievable by any attacker who has obta
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could b
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP 2FA w
Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.2.0. Rated medium severity (CVSS
The WP 2FA - Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in
The WP 2FA - Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Refere
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today