HIGH
CVE-2026-15372
CVSS
7.5
Description
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.
Weakness (CWE)
CWE-287
Improper Authentication
EPSS Score
0.36%
Probability of exploitation in next 30 days
30.3th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.