What the vulnerability does
01Description
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the send_backup_codes_email function. This makes it possible for unauthenticated attackers to send emails with arbitrary content to registered users via a forged request granted they can trick a site administrator or other registered user into performing an action such as clicking on a link. While a nonce check is present, it is only executed if a nonce is set. By omitting a nonce from the request, the check can be bypassed.
Explanation of Vulnerability in Simple Terms
02Summary
WP 2FA contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability requires the user to visit a malicious page while logged into WordPress. An attacker can modify plugin settings or disable two-factor authentication for the victim's account.
What an attacker can do
03Attacker Capabilities
Trick a logged-in user into disabling 2FA or changing plugin settings via a malicious webpage.
Potential impact on your site
04Site Impact
Users' two-factor authentication can be disabled without their knowledge, weakening account security.
Conditions required to exploit
05Prerequisites
Victim must be logged into WordPress and click a link or visit an attacker-controlled page.
Key dates
06Disclosure timeline
January 11, 2024
CVE published
April 8, 2026
Record updated
