CVE-2022-28986: Lmsdoctor 2 Factor Authentication

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts.

Affected products

• Lmsdoctor 2 Factor Authentication: version 2021072900 only

Published 2022-05-10. Last modified 2026-07-09.