Two Factor Authentication <= 1.16.0 - Unauthenticated Authentication Bypass via WooCommerce Password Reset
- ID
- WPSEC-2026-1739
- Plugin
- Two Factor Authentication (two-factor-authentication)
- Affected
- all versions before 1.17.0
- Remediation
- Update to 1.17.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-308
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-27
- Attack surface
- Two Factor Authentication on WPSec AttackSurface
- Fix released
- Published
Description
The Two Factor Authentication plugin for WordPress is vulnerable to a two-factor authentication bypass via the WooCommerce "Lost password" feature in all versions up to, and including, 1.16.0. This is due to the plugin not ending the session WooCommerce can create when a user with two-factor authentication active resets their password. This makes it possible for unauthenticated attackers who can read the email account that receives a victim's password reset link to log in as that user without providing a TFA code. Exploitation requires WooCommerce to be active, and a WooCommerce version that logs the user in after a password reset.
References
- https://wpsec.com/vuln/WPSEC-2026-1739/
- https://plugins.svn.wordpress.org/two-factor-authentication/tags/1.17.0/
- https://wordpress.org/plugins/two-factor-authentication/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS