WP 2FA login method permits second-factor bypass
WP 2FA before 4.1.0 fails to validate the second factor when one supported authentication method is selected during login. An attacker who already knows the target's WordPress password can choose the affected method, bypass two-factor verification and obtain the full user session, including an administrator session. This unscored record received deeper review because it is an authentication-bypass primitive. The CNA does not disclose the affected method, login action or request parameter.
- Component
- WP 2FA
- Plugin slug
wp-2fa- Affected
- < 4.1.0
- Safe version
4.1.0- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 10 known issues for this plugin.
Update, patch or deactivate.
Update WP 2FA to 4.1.0 or later. Review privileged logins and second-factor events, reset credentials where passwords may be known to attackers and invalidate affected sessions.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N