CVE-2026-15372 — WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider

CVE-2026-15372

WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider PUBLISHED

Description (CNA)

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.

Affected (CNA)

Vendor / product	Versions
Unknown / WP 2FA	affected 0 before 4.1.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a8d697c9-6de4-4a28-be9e-7d42abcb6c7e/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.