CVE-2026-15372

WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.

Affected

WP 2FA

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.52% chance of exploitation in the next 30 days, 43rd percentile

Published

2026-08-05

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a8d697c9-6de4-4a28-be9e-7d42abcb6c7e/

References

• CVE Record
• NVD entry