CVE-2026-11883 — WebAuthn Provider for Two Factor < 2.5.6 - 2FA Bypass

CVE-2026-11883

WebAuthn Provider for Two Factor < 2.5.6 - 2FA Bypass PUBLISHED

Description (CNA)

The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request.

Affected (CNA)

Vendor / product	Versions
Unknown / WebAuthn Provider for Two Factor	affected 0 before 2.5.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/f718390c-1d7c-4048-bce6-a3170998e828/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.