CVE-2026-12988

MediumCVSS 6.4

Published: 14/07/2026(UTC)Updated: 14/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

The WP 2FA WordPress plugin before version 3.1.1.2 does not verify that the email address provided during two-factor authentication setup belongs to the user. This allows an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.

Risk Assessment

The risk is that an attacker who has obtained a user's login credentials can hijack the account, potentially leading to unauthorized access to sensitive data or further attacks within the organization.

Recommendation

Immediately update the WP 2FA plugin to version 3.1.1.2 or later, which includes a fix for this vulnerability.

Other vulnerabilities in WP 2FA

CVE-2026-15372High
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.

Original NVD description (English source)

The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.