{
 "id": "WPSEC-2026-1739",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1739/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1739/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1739/index.md",
 "title": "Two Factor Authentication <= 1.16.0 - Unauthenticated Authentication Bypass via WooCommerce Password Reset",
 "description": "The Two Factor Authentication plugin for WordPress is vulnerable to a two-factor authentication bypass via the WooCommerce \"Lost password\" feature in all versions up to, and including, 1.16.0. This is due to the plugin not ending the session WooCommerce can create when a user with two-factor authentication active resets their password. This makes it possible for unauthenticated attackers who can read the email account that receives a victim's password reset link to log in as that user without providing a TFA code. Exploitation requires WooCommerce to be active, and a WooCommerce version that logs the user in after a password reset.",
 "plugin": {
  "slug": "two-factor-authentication",
  "name": "Two Factor Authentication",
  "full_name": "Two Factor Authentication",
  "wordpress_org": "https://wordpress.org/plugins/two-factor-authentication/",
  "advisories_url": "https://wpsec.com/vuln/plugin/two-factor-authentication/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/two-factor-authentication"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-308"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.17.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.17.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.17.0",
 "remediation": "Update to 1.17.0 or later.",
 "fix_released": "2026-10-26T13:06:43+00:00",
 "published": "2026-10-27T13:53:32+00:00",
 "updated": "2026-10-27T13:38:38.669767+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1739/",
  "https://plugins.svn.wordpress.org/two-factor-authentication/tags/1.17.0/",
  "https://wordpress.org/plugins/two-factor-authentication/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/two-factor-authentication",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-27"
 }
}