WP 2FA vulnerabilities
We track 3 vulnerabilities in WP 2FA products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 3, 2026.
Latest WP 2FA vulnerabilities
- 7.5 High severity
WP 2FA: Improper Authentication
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor
- 7.5 High severity
WP 2FA: Improper Authentication
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access th
- 7.5 High severity
WP 2FA: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in WP 2FA allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP 2FA: from n/a through 2.6.3.