{
 "id": "WPSEC-2026-1740",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1740/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1740/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1740/index.md",
 "title": "Two Factor Authentication <= 1.16.0 - Authenticated (Subscriber+) Authentication Bypass via 'creds_user_id' Parameter",
 "description": "The Two Factor Authentication plugin for WordPress is vulnerable to a two-factor authentication bypass via the 'creds_user_id' login parameter in all versions up to, and including, 1.16.0. This is due to the login handler taking a 'creds_user_id' value from the POST request, which was meant to be set only by the 'simbatfa_auth_user_from_login_params' filter, and using it to choose which account's TFA code is checked. This makes it possible for authenticated attackers, with subscriber-level access and above, who have TFA enabled on their own account, to log into another user's account with their own TFA code instead of the victim's. The attacker must already know the target account's password.",
 "plugin": {
  "slug": "two-factor-authentication",
  "name": "Two Factor Authentication",
  "full_name": "Two Factor Authentication",
  "wordpress_org": "https://wordpress.org/plugins/two-factor-authentication/",
  "advisories_url": "https://wpsec.com/vuln/plugin/two-factor-authentication/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/two-factor-authentication"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.2.12",
    "from_inclusive": true,
    "to": "1.17.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.2.12 before 1.17.0"
  ]
 },
 "introduced_in": "1.2.12",
 "fixed_in": "1.17.0",
 "remediation": "Update to 1.17.0 or later.",
 "fix_released": "2026-10-26T13:06:43+00:00",
 "published": "2026-10-27T13:53:32+00:00",
 "updated": "2026-10-27T13:38:38.669767+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1740/",
  "https://plugins.svn.wordpress.org/two-factor-authentication/tags/1.17.0/",
  "https://wordpress.org/plugins/two-factor-authentication/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/two-factor-authentication",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-27"
 }
}