CVE-2025-12628

The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them

CVSS v3.1

6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

0.21% chance of exploitation in the next 30 days, 10th percentile

Published

2025-11-24

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/5e2d033c-dde6-4774-8588-cbe268c0d797/

References

• CVE Record
• NVD entry

Related

• CVE-2025-12626
• CVE-2025-12629
• CVE-2025-12623
• CVE-2025-12630
• CVE-2025-12622
• CVE-2025-12653