PT-2026-113674 · Undefined · Undefined
CVE-2026-108066
·
Published
2026-10-14
·
Updated
2026-10-14
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undefined