CVE-2026-103514
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.
Risk Assessment
Bypassing 2FA significantly weakens account protection, including administrative accounts, and can lead to full compromise of the WordPress site. The risk is high if a password has leaked or been intercepted.
Recommendation
Update the WP 2FA plugin to version 4.1.0 or later. Consider rotating passwords and reconfiguring 2FA for highly privileged accounts.
Other vulnerabilities in WP 2FA
See all- CVE-2026-62142High
A Cross-Site Request Forgery (CSRF) vulnerability in WP 2FA from Melapress allows Cross Site Request Forgery. This issue affects WP 2FA from n/a through 4.1.0.
- CVE-2026-15372High
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.
- CVE-2026-12988Medium
The WP 2FA WordPress plugin before version 3.1.1.2 does not verify that the email address provided during two-factor authentication setup belongs to the user. This allows an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.
- CVE-2025-12628Medium
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them.
Original NVD description (English source)
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS