WordPress plugin
WP 2FA – Two-factor authentication for WordPress security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 14 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium13
- Low1
All WP 2FA – Two-factor authentication for WordPress vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Low2.7 | Authenticated (Administrator+) Insecure Direct Object Reference <4.2.0Update to 4.2.0 | CVE-2026-108066 | |
| Medium4.3 | Cross-Site Request Forgery ≤4.1.0Update to 4.2.0 | CVE-2026-62142 | |
| Medium4.3 | Unauthenticated Two-Factor Authentication Bypass ≤4.0.0Update to 4.1.0 | CVE-2026-103514 | |
| Medium4.3 | Two-Factor Authentication Bypass ≤4.0.0Update to 4.1.0 | CVE-2026-15372 | |
| Medium4.3 | Authenticated (Subscriber+) Account Takeover ≤3.1.1.1Update to 3.1.1.2 | CVE-2026-12988 | |
| Medium5.3 | 2-Factor Authentication Bypass ≤2.9.3Update to 3.0.0 | CVE-2025-12628 | |
| Medium5.3 | Unauthenticated Information Exposure via Log File ≤2.6.3Update to 2.6.4 | CVE-2022-44587 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤2.6.2Update to 2.6.3 | CVE-2024-32568 | |
| Medium4.3 | Cross-Site Request Forgery ≤2.5.0Update to 2.6.0 | CVE-2023-6520 | |
| Medium4.3 | Insecure Direct Object Reference to Arbitrary Email Sending ≤2.5.0Update to 2.6.0 | CVE-2023-6506 | |
| Medium4.3 | Missing Authorization ≤2.2.0Update to 2.2.1 | CVE-2022-44595 | |
| Medium5.3 | Time-Based TOTP attack to Sensitive Information Exposure ≤2.2.1Update to 2.3.0 | CVE-2022-2891 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤2.2.0Update to 2.2.1 | CVE-2022-1527 | |
| Medium5.4 | Insecure Direct Object Reference ≤2.1.0Update to 2.2.0 | — |
- Low2.7Authenticated (Administrator+) Insecure Direct Object Reference
<4.2.0Update to 4.2.0
- Medium4.3Cross-Site Request Forgery
≤4.1.0Update to 4.2.0
- Medium4.3Unauthenticated Two-Factor Authentication Bypass
≤4.0.0Update to 4.1.0
- Medium4.3Two-Factor Authentication Bypass
≤4.0.0Update to 4.1.0
- Medium4.3Authenticated (Subscriber+) Account Takeover
≤3.1.1.1Update to 3.1.1.2
- Medium5.32-Factor Authentication Bypass
≤2.9.3Update to 3.0.0
- Medium5.3Unauthenticated Information Exposure via Log File
≤2.6.3Update to 2.6.4
- Medium6.1Reflected Cross-Site Scripting
≤2.6.2Update to 2.6.3
- Medium4.3Cross-Site Request Forgery
≤2.5.0Update to 2.6.0
- Medium4.3Insecure Direct Object Reference to Arbitrary Email Sending
≤2.5.0Update to 2.6.0
- Medium4.3Missing Authorization
≤2.2.0Update to 2.2.1
- Medium5.3Time-Based TOTP attack to Sensitive Information Exposure
≤2.2.1Update to 2.3.0
- Medium6.1Reflected Cross-Site Scripting
≤2.2.0Update to 2.2.1
- Medium5.4Insecure Direct Object Reference
≤2.1.0Update to 2.2.0
WP 2FA – Two-factor authentication for WordPress: common questions
Does WP 2FA – Two-factor authentication for WordPress have known vulnerabilities?
Yes. VulnCrest Radar lists 14 known vulnerabilities in WP 2FA – Two-factor authentication for WordPress: 13 medium, 1 low. None are known to affect version null.
How do I check which version of WP 2FA – Two-factor authentication for WordPress I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP 2FA – Two-factor authentication for WordPress vulnerability?
CVE-2026-108066, published Oct 14, 2026: WP 2FA – Two-factor authentication for WordPress < 4.2.0 - Authenticated (Administrator+) Insecure Direct Object Reference. Severity: Low (CVSS 2.7).
Is any WP 2FA – Two-factor authentication for WordPress vulnerability listed in CISA KEV?
No. None of the known WP 2FA – Two-factor authentication for WordPress vulnerabilities is currently listed in the CISA KEV catalog.