CVE-2026-15372

None

Open

TLP:CLEAR

WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.

Details

EPSS Score ⓘ: 0.36%

29.4th percentile
Confidence: 90%
Published: Aug 5, 2026
Last Modified: Aug 5, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.