CVE-2024-9820

Name of the Vulnerable Software and Affected Versions WP 2FA with Telegram plugin for WordPress versions up to, and including, 3.0

Description The issue is related to Two-Factor Authentication Bypass. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication.

Recommendations For versions up to, and including, 3.0, consider disabling the two-factor authentication feature until a patch is available. Restrict access to sensitive areas of the WordPress site to minimize the risk of exploitation. Avoid relying solely on the two-factor authentication provided by the WP 2FA with Telegram plugin for security. At the moment, there is no information about a newer version that contains a fix for this vulnerability.