CVE-2026-15372

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.36% chance of exploitation in the next 30 days, 29th percentile

Published

2026-08-05

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a8d697c9-6de4-4a28-be9e-7d42abcb6c7e/

References

• CVE Record
• NVD entry

Related

• CVE-2026-15368
• CVE-2026-15373
• CVE-2026-15361
• CVE-2026-15374
• CVE-2026-15360
• CVE-2026-15375