Wp 2Fa
Monthly
Cross-site request forgery in the Melapress WP 2FA WordPress plugin, affecting all versions through 4.1.0, allows an attacker to make a logged-in privileged WordPress user - typically an administrator with access to the two-factor authentication settings - perform unintended state-changing WP 2FA actions by tricking them into visiting a malicious page or link while their session is active. The input CVSS 3.1 vector scores 8.8 (High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but an independent reassessment places integrity impact as the dominant concern (C:L/I:H/A:N), since exploitation is wholly dependent on a victim who is both authenticated and successfully lured into interaction (UI:R); no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing). Despite the high headline score, the practical attack surface is constrained by the required user interaction, a valid privileged session at the time of the lure, and the fact that the specific vulnerable endpoint and action are not disclosed in the available data; the underlying defect is a missing or inadequate anti-CSRF nonce check on a WP 2FA request in versions up to and including 4.1.0.
TOTP replay in the WP 2FA WordPress plugin (versions before 4.1.0) allows an attacker who already knows an account's password and can capture a valid time-based one-time passcode within its ~30-second validity window to reuse that same code and complete login without ever knowing the second factor - including on administrator accounts. The defect (CWE-287, improper authentication) is that consumed codes are never invalidated, so replays succeed while the code is still live; this does not allow bypass from scratch, since it requires prior credential compromise plus real-time observation of a code via phishing, a proxy, MITM, or logging. Exploitation is conditional and targeted rather than scalable, consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N (7.5) and the very low EPSS of 0.19% (8th percentile); publicly available exploit code exists, but there is no CISA KEV evidence of active exploitation. The vendor has released a fix in WP 2FA 4.1.0, and the issue is tracked as EUVD-2026-91934.
Two-factor authentication bypass in the WP 2FA WordPress plugin before 4.1.0 allows an attacker who possesses a valid user password to completely skip the second authentication factor and gain full account access, including administrator-level accounts. The plugin presents the 2FA challenge but fails to server-side validate the submitted factor for any of its supported methods, rendering 2FA protections entirely ineffective. A publicly available exploit exists (sourced from WPScan), though EPSS sits at 0.19% (9th percentile), indicating limited observed exploitation activity at time of analysis despite the public proof-of-concept.
Site administrators on a WordPress Multisite network can strip the two-factor authentication configuration of user accounts belonging to other sites - including accounts they are not permitted to edit - in the WP 2FA plugin before version 4.2.0, because the 2FA-removal routine is missing an object-level capability check (CWE-639). The issue is scored CVSS 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) and only crosses a genuine trust boundary on Multisite installs, since single-site administrators already manage all users; publicly available exploit code exists, but there is no indication of active exploitation and EPSS is only 0.22% (12th percentile). Impact is limited to removing - not reading, forging, or bypassing inline - another user's 2FA configuration, which weakens that account's authentication posture for as long as the victim does not notice and re-enroll.
Account takeover in the WP 2FA WordPress plugin (all versions before 3.1.1.2) is achievable by any attacker who has obtained a valid user's credentials. The plugin fails to verify that the email address submitted during two-factor authentication enrollment belongs to the authenticated account (CWE-862: Missing Authorization), allowing the attacker to redirect the setup verification code to an attacker-controlled inbox and complete 2FA enrollment on behalf of the victim. A publicly available proof-of-concept exists per WPScan; this vulnerability is not currently listed in the CISA KEV catalog, but the combination of a PoC, medium-prevalence deployment, and account-takeover impact warrants prompt patching.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP 2FA wp-2fa.6.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP 2FA - Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The WP 2FA - Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site request forgery in the Melapress WP 2FA WordPress plugin, affecting all versions through 4.1.0, allows an attacker to make a logged-in privileged WordPress user - typically an administrator with access to the two-factor authentication settings - perform unintended state-changing WP 2FA actions by tricking them into visiting a malicious page or link while their session is active. The input CVSS 3.1 vector scores 8.8 (High, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but an independent reassessment places integrity impact as the dominant concern (C:L/I:H/A:N), since exploitation is wholly dependent on a victim who is both authenticated and successfully lured into interaction (UI:R); no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing). Despite the high headline score, the practical attack surface is constrained by the required user interaction, a valid privileged session at the time of the lure, and the fact that the specific vulnerable endpoint and action are not disclosed in the available data; the underlying defect is a missing or inadequate anti-CSRF nonce check on a WP 2FA request in versions up to and including 4.1.0.
TOTP replay in the WP 2FA WordPress plugin (versions before 4.1.0) allows an attacker who already knows an account's password and can capture a valid time-based one-time passcode within its ~30-second validity window to reuse that same code and complete login without ever knowing the second factor - including on administrator accounts. The defect (CWE-287, improper authentication) is that consumed codes are never invalidated, so replays succeed while the code is still live; this does not allow bypass from scratch, since it requires prior credential compromise plus real-time observation of a code via phishing, a proxy, MITM, or logging. Exploitation is conditional and targeted rather than scalable, consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N (7.5) and the very low EPSS of 0.19% (8th percentile); publicly available exploit code exists, but there is no CISA KEV evidence of active exploitation. The vendor has released a fix in WP 2FA 4.1.0, and the issue is tracked as EUVD-2026-91934.
Two-factor authentication bypass in the WP 2FA WordPress plugin before 4.1.0 allows an attacker who possesses a valid user password to completely skip the second authentication factor and gain full account access, including administrator-level accounts. The plugin presents the 2FA challenge but fails to server-side validate the submitted factor for any of its supported methods, rendering 2FA protections entirely ineffective. A publicly available exploit exists (sourced from WPScan), though EPSS sits at 0.19% (9th percentile), indicating limited observed exploitation activity at time of analysis despite the public proof-of-concept.
Site administrators on a WordPress Multisite network can strip the two-factor authentication configuration of user accounts belonging to other sites - including accounts they are not permitted to edit - in the WP 2FA plugin before version 4.2.0, because the 2FA-removal routine is missing an object-level capability check (CWE-639). The issue is scored CVSS 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) and only crosses a genuine trust boundary on Multisite installs, since single-site administrators already manage all users; publicly available exploit code exists, but there is no indication of active exploitation and EPSS is only 0.22% (12th percentile). Impact is limited to removing - not reading, forging, or bypassing inline - another user's 2FA configuration, which weakens that account's authentication posture for as long as the victim does not notice and re-enroll.
Account takeover in the WP 2FA WordPress plugin (all versions before 3.1.1.2) is achievable by any attacker who has obtained a valid user's credentials. The plugin fails to verify that the email address submitted during two-factor authentication enrollment belongs to the authenticated account (CWE-862: Missing Authorization), allowing the attacker to redirect the setup verification code to an attacker-controlled inbox and complete 2FA enrollment on behalf of the victim. A publicly available proof-of-concept exists per WPScan; this vulnerability is not currently listed in the CISA KEV catalog, but the combination of a PoC, medium-prevalence deployment, and account-takeover impact warrants prompt patching.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP 2FA wp-2fa.6.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP 2FA - Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The WP 2FA - Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.