high7.5
CVE-2026-103514
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's …
Impact
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.
Affected products
| Product | Affected versions |
|---|---|
| WP 2FA WordPress Plugin | before 4.1.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.