CVE-2026-15372: Unknown Wp 2fa

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.

Affected products

• Unknown Wp 2fa: before 4.1.0 (fixed in 4.1.0)

Published 2026-08-05. Last modified 2026-08-26.