AuthPress vulnerabilities

2 known vulnerabilities in AuthPress from Dueclic. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  AuthPress: Reliance on Cookies without Validation and Integrity Checking

  CVE-2024-9820Oct 15, 2024Dueclic

  The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication.

• 8.8 High severity

  AuthPress: Authorization Bypass Through User-Controlled Key

  CVE-2024-9687Oct 15, 2024Dueclic

  The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validate_tg' action. This makes it possible for authenticated