CVE-2026-15372 — WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who alr…
Published: 2026-08-05 · CVSS: 7.5 · CVSS 3.1
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7