Security Advisory

CVE-2026-12988

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-14 06:00:02

Last updated 2026-07-14 12:24:36

Assigner WPScan

CVSS score not scored

State PUBLISHED

Description

The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.

← Browse all CVEs View on cve.org ↗