WP 2FA CVE-2026-15372

The attacker must already possess a valid WordPress username and password for the target account - the first authentication factor (password) must be correct. The vulnerability only bypasses the second factor; it does not eliminate the need for valid credentials. Exploitation requires the WP 2FA plugin to be installed, activated, and the target user to have a 2FA method configured and enabled on their account - users who have not enrolled in 2FA are not protected by this plugin but also are not directly affected by this specific bypass. No server-side configuration beyond plugin installation is required. Exploitation is limited by the credential prerequisite: if the attacker cannot obtain the target's password, this vulnerability is not exploitable. Administrator accounts are explicitly called out as reachable targets, maximizing potential blast radius when admin credentials are compromised.

The NVD-assigned CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) warrants scrutiny. The PR:N assignment is debatable: exploitation requires prior possession of the victim's account password, which functions as a meaningful access prerequisite - AC:H and I:H/A:H are arguably more accurate given the full account takeover impact (see assessed vector). The C:H/I:N/A:N impact split is also likely underscored: full WordPress admin account access enables content modification, plugin installation, and potential server-side code execution, implying I:H and A:H are more realistic. EPSS at 0.19% (9th percentile) is low despite the public exploit, suggesting exploitation remains targeted rather than automated mass-scanning. No CISA KEV listing is present, reinforcing this as not yet confirmed actively exploited at scale. The public POC from WPScan increases the operational risk window for sites that have not patched. For organizations where WordPress admin compromise would be high-impact, this is a real priority due to the credential-bypass nature undermining a security control users explicitly rely upon.

An attacker who has obtained valid WordPress credentials for a target account (via phishing, credential stuffing from a prior breach, or password guessing) navigates to the wp-login.php page, authenticates with the stolen password, and when prompted for the 2FA code submits an empty or arbitrary token. The plugin fails to validate the second factor and grants a fully authenticated session. A publicly available exploit exists at the WPScan reference, demonstrating this bypass against affected plugin versions.