What’s Vulnerable › Vulnerabilities
CVE-2026-15372: WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-05 · updated 2026-08-26
- Weakness: CWE-287
Description
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.
Affected products
- WP 2FA: before 4.1.0 — fixed in 4.1.0
How to fix
Upgrade to a fixed version: WP 2FA 4.1.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-15372 or the next vulnerability affects your stack