# Two Factor Authentication <= 1.16.0 - Unauthenticated Authentication Bypass via WooCommerce Password Reset

- **ID:** WPSEC-2026-1739
- **Plugin:** Two Factor Authentication (`two-factor-authentication`), https://wordpress.org/plugins/two-factor-authentication/
- **Affected versions:** all versions before 1.17.0
- **Fixed in:** 1.17.0 (Update to 1.17.0 or later.)
- **Severity:** High 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-308
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/two-factor-authentication
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1739/

## Description

The Two Factor Authentication plugin for WordPress is vulnerable to a two-factor authentication bypass via the WooCommerce "Lost password" feature in all versions up to, and including, 1.16.0. This is due to the plugin not ending the session WooCommerce can create when a user with two-factor authentication active resets their password. This makes it possible for unauthenticated attackers who can read the email account that receives a victim's password reset link to log in as that user without providing a TFA code. Exploitation requires WooCommerce to be active, and a WooCommerce version that logs the user in after a password reset.

## References

- https://wpsec.com/vuln/WPSEC-2026-1739/
- https://plugins.svn.wordpress.org/two-factor-authentication/tags/1.17.0/
- https://wordpress.org/plugins/two-factor-authentication/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1739/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.