CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. This is because the SS88_2FAVE::wp_login() method only enforces the 2FA requirement if the 'token' HTTP GET parameter is undefined, which makes it possible to bypass two-factor authentication by supplying any value in the 'token' parameter during login, including an empty one.
Explanation of Vulnerability in Simple Terms
Two Factor (2FA) Authentication via Email versions up to 1.9.8 contain an input validation flaw that allows authenticated users to modify data they should not have access to. An attacker with a low-privilege account can bypass intended restrictions and alter records through improper input handling. This affects the integrity of protected data but does not expose sensitive information or disrupt service availability.
What an attacker can do
Modify or alter data in the application that should be restricted from their account level.
Potential impact on your site
Users' data integrity may be compromised; unauthorized modifications could occur within the 2FA system.
Conditions required to exploit
Attacker must have a valid low-privilege user account and network access to the application.
Key dates
External resources
Related vulnerabilities
