Unknown Wp 2fa vulnerabilities

5 CVEs affecting Unknown Wp 2fa, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-108066, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-15372, published 2026-08-05. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's…
CVE-2026-108066, published 2026-10-14. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on…
CVE-2026-103514, published 2026-10-03. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code…
CVE-2026-12988, published 2026-07-14. Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days. The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's…
CVE-2025-12628, published 2025-11-24. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them