Bypass of Two-Factor Authentication in WP 2FA Plugin by WordPress
CVE-2026-103514
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-103514?
The WP 2FA plugin for WordPress prior to version 4.1.0 allows for a critical security issue where a time-based one-time passcode (TOTP) remains valid even after being used. This flaw enables an attacker with knowledge of a user's password and access to a valid TOTP within its active period to replay the code, effectively bypassing the two-factor authentication mechanism. Such exploitation poses severe risks, particularly to administrators and other privileged accounts.
Affected Version(s)
WP 2FA 0 < 4.1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.