CVE-2026-15372
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.
Risk Assessment
An attacker can gain full access to user accounts, including administrators, potentially leading to site takeover and data breach.
Recommendation
Update the WP 2FA plugin to version 4.1.0 or later. Additionally, consider implementing additional security measures such as login monitoring and IP restrictions.
Other vulnerabilities in WP 2FA
Original NVD description (English source)
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.