CVE-2026-108066
WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR
LOW 2.7EPSS 0.3%
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
- Affected
- WP 2FA
- CVSS v3.1 CNA
- 2.7 LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - EPSS
- 0.33% chance of exploitation in the next 30 days, 25th percentile
- Published
- 2026-10-14
- Updated
- 2026-10-15