Security Advisory

CVE-2026-15372

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-05 06:00:12

Last updated 2026-08-05 15:15:35

Assigner WPScan

CVSS score not scored

State PUBLISHED

Description

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.

← Browse all CVEs View on cve.org ↗