Security Advisory

CVE-2026-103514

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-10-03 06:00:25

Last updated 2026-10-03 15:12:22

Assigner WPScan

CVSS score 7.5

State PUBLISHED

Description

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.

← Browse all CVEs View on cve.org ↗