PT-2026-104520
CVE-2026-103514
·
تاريخ النشر
2026-10-01
·
تاريخ التحديث
2026-10-04
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
WP 2FA WordPress plugin versions prior to 4.1.0
Description
The plugin fails to invalidate a time-based one-time passcode after its initial use. This allows an attacker who possesses a user's password and has intercepted a valid code during its validity window to replay that code and bypass two-factor authentication, which can include access to administrator accounts.
Recommendations
Update the plugin to version 4.1.0 or later.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾