high7.5
CVE-2026-15372
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an…
Impact
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.
Affected products
| Product | Affected versions |
|---|---|
| WP 2FA WordPress Plugin | before 4.1.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.