WordPress WP 2FA Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS)<\/p>
Software: WP 2FA<\/p>
Link: https:\/\/wordpress.org\/plugins\/wp-2fa\/#developers<\/p>
Affected Version <= 2.6.2<\/p>
Fixed in version 2.6.3 <\/p>","date":"2024-04-16"},{"id":"18f7967bdea48cd20a847ed8dfd0a8faa4ac6b9f","name":"WP 2FA \u2013 Two-factor authentication for WordPress <= 2.6.2 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-2fa\/wp-2fa-two-factor-authentication-for-wordpress-262-reflected-cross-site-scripting","description":"The WP 2FA \u2013 Two-factor authentication for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2024-04-16"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"ab843de3eacddeb4c3748010e9b7615575409ff49f73aec34c0632921b32e8a5","name":"WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 2.6.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.6.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2022-44587","name":"CVE-2022-44587","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-44587","description":"[en] Insertion of Sensitive Information into Log File vulnerability in WP 2FA allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP 2FA: from n\/a through 2.6.3.","date":"2024-06-21"},{"id":"1c79ac2678a7b92b4282f8a7e1f3ddf968b49501","name":"WordPress WP 2FA Plugin <= 2.6.3 is vulnerable to Sensitive Data Exposure","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/wp-2fa\/vulnerability\/wordpress-wp-2fa-plugin-2-6-3-sensitive-data-exposure-via-log-file-vulnerability","description":"
WordPress WP 2FA Plugin <= 2.6.3 is vulnerable to Sensitive Data Exposure<\/p>
Software: WP 2FA<\/p>
Link: https:\/\/wordpress.org\/plugins\/wp-2fa\/#developers<\/p>
Affected Version <= 2.6.3<\/p>
Fixed in version 2.6.4 <\/p>","date":"2024-06-20"},{"id":"ad91101e82177be91887f549c0cf23b0e98e7439","name":"WP 2FA <= 2.6.3 - Unauthenticated Information Exposure via Log File","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-2fa\/wp-2fa-263-unauthenticated-information-exposure-via-log-file","description":"The WP 2FA \u2013 Two-factor authentication for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.3 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.","date":"2024-06-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"5.3","severity":"m","exploitable":"3.9","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"3.9","impact":"3.6"},"cwe":[{"cwe":"CWE-532","name":"Insertion of Sensitive Information into Log File","description":"The product writes sensitive information to a log file."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"c3bdcc94c2458c0c0d5da40c773104138212eda88eef15c41dcac6f5dac2e742","name":"WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 3.0.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.0.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-12628","name":"CVE-2025-12628","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-12628","description":"[en] The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them","date":"2025-11-24"},{"id":"100a23710e4f9d32cb9f4d7a803a1b2b8a84cae1","name":"WP 2FA \u2013 Two-factor authentication for WordPress <= 2.9.3 - 2-Factor Authentication Bypass","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-2fa\/wp-2fa-two-factor-authentication-for-wordpress-293-2-factor-authentication-bypass","description":"The WP 2FA \u2013 Two-factor authentication for WordPress plugin for WordPress is vulnerable to 2FA bypass in all versions up to, and including, 2.9.3. This makes it possible for unauthenticated attackers to bypass 2FA protection. Please note Wordfence does not consider this a security vulnerability and previously rejected assigning a CVE ID to this issue. This is being included for informational purposes.","date":"2025-11-03"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"l","a":"l","score":"6.3","severity":"m","exploitable":"2.8","impact":"3.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L","score":"6.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"low","i":"low","a":"low","exploitable":"2.8","impact":"3.4"},"cwe":[{"cwe":"CWE-331","name":"Insufficient Entropy","description":"The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"fd8d482050db59d70ee564b86f30a983d07acd529f4ca64a5b275223b2824798","name":"WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 3.1.1.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.1.1.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-12988","name":"CVE-2026-12988","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-12988","description":"[en] The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.","date":"2026-07-14"},{"id":"97ab65e0f4a4750b0a174c433d16f6ccc515ca2f","name":"WP 2FA <= 3.1.1.1 - Authenticated (Subscriber+) Account Takeover","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/wp-2fa\/wp-2fa-3111-authenticated-subscriber-account-takeover","description":"The WP 2FA \u2013 Two-factor authentication for WordPress plugin for WordPress is vulnerable to accoutn takeover in all versions up to, and including, 3.1.1.1. This is due to the plugin not properly verifying an email during 2FA enrollment. This makes it possible for authenticated attackers, with subscriber-level access and above, to complete verification for other users gaining access to their account.","date":"2026-06-23"}],"impact":{"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"6dd9dd1b5a0ad7b862ff1b54cec990bf1325832395e9ce34bc63c24de1687308","name":"WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 4.1.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-15372","name":"CVE-2026-15372","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-15372","description":"[en] The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.","date":"2026-08-05"}],"impact":{"cwe":[{"cwe":"CWE-287","name":"Improper Authentication","description":"When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1785997282"}