Improper Cross-Site User Authentication in WP 2FA Plugin by WordPress
CVE-2026-108066
Key Information:
Badges
What is CVE-2026-108066?
The WP 2FA plugin for WordPress prior to version 4.2.0 is susceptible to a vulnerability that allows site administrators on Multisite installations to bypass proper authorization checks. This flaw enables them to remove the two-factor authentication (2FA) configurations of users from different sites within the network, even if they do not have permission to manage those accounts. On single-site installations, this behavior does not pose as significant a risk, as administrators inherently have control over all users. However, the issue represents a critical oversight in user trust boundaries in a Multisite environment, potentially exposing accounts to unauthorized access.
Affected Version(s)
WP 2FA 0 < 4.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.