Privilege Escalation in Keyy Two Factor Authentication Plugin for WordPress

CVE-2025-10293

What is CVE-2025-10293?

The Keyy Two Factor Authentication plugin for WordPress is susceptible to a privilege escalation vulnerability due to inadequate validation of user identities associated with generated tokens. This flaw enables authenticated attackers, even with subscriber-level access, to forge valid authentication tokens. As a result, they can execute an auto-login to other users' accounts, including those of administrators who have set up two-factor authentication, thus compromising account security and user data.

References