Advisories · Technology
WP 2FA.
Every CVE that names WP 2FA among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.7 Low
WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR
- WP 2FA
- Broken access control
- CVSS 7.5 High
WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay
- WP 2FA
- Authentication bypass
- CVSS 7.5 High
WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider
- WP 2FA
- Authentication bypass
- CVSS 6.4 Medium
WP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Binding
- WP 2FA
- Broken access control
- CVSS 6.3 Medium
WP 2FA < 3.0.0 - Second Factor Bypass
- WP 2FA
- CVSS 5.3 Medium
WordPress WP 2FA plugin <= 2.6.3 - Sensitive Data Exposure via Log File vulnerability
- WP 2FA
- Information disclosure
-
WP 2FA < 2.3.0 - Time-Based Side-Channel Attack
- WP 2FA