PT-2026-104520

CVE-2026-103514

Published

2026-10-01

Updated

2026-10-04

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP 2FA WordPress plugin versions prior to 4.1.0

Description The plugin fails to invalidate a time-based one-time passcode after its initial use. This allows an attacker who possesses a user's password and has intercepted a valid code during its validity window to replay that code and bypass two-factor authentication, which can include access to administrator accounts.

Recommendations Update the plugin to version 4.1.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Suhayb Ahmed

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

Related identifiers