Two Factor Authentication <= 1.16.0 - Authenticated (Subscriber+) Authentication Bypass via 'creds_user_id' Parameter
- ID
- WPSEC-2026-1740
- Plugin
- Two Factor Authentication (two-factor-authentication)
- Affected
- from 1.2.12 before 1.17.0
- Remediation
- Update to 1.17.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-27
- Attack surface
- Two Factor Authentication on WPSec AttackSurface
- Fix released
- Published
Description
The Two Factor Authentication plugin for WordPress is vulnerable to a two-factor authentication bypass via the 'creds_user_id' login parameter in all versions up to, and including, 1.16.0. This is due to the login handler taking a 'creds_user_id' value from the POST request, which was meant to be set only by the 'simbatfa_auth_user_from_login_params' filter, and using it to choose which account's TFA code is checked. This makes it possible for authenticated attackers, with subscriber-level access and above, who have TFA enabled on their own account, to log into another user's account with their own TFA code instead of the victim's. The attacker must already know the target account's password.
References
- https://wpsec.com/vuln/WPSEC-2026-1740/
- https://plugins.svn.wordpress.org/two-factor-authentication/tags/1.17.0/
- https://wordpress.org/plugins/two-factor-authentication/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS