Authentication Bypass Vulnerability in WP 2FA with Telegram Plugin

CVE-2024-9687

Summary

The WP 2FA with Telegram plugin for WordPress, specifically in versions up to and including 3.0, is affected by an authentication bypass vulnerability. This arises from inadequate validation of a user-controlled key during the 'validate_tg' action. As a result, authenticated attackers with at least subscriber-level permissions can exploit this flaw to gain unauthorized access, potentially allowing them to log in as any existing user on the site, including administrators, thereby compromising the integrity and security of the affected WordPress installations.

References