# Two Factor Authentication <= 1.16.0 - Authenticated (Subscriber+) Authentication Bypass via 'creds_user_id' Parameter

- **ID:** WPSEC-2026-1740
- **Plugin:** Two Factor Authentication (`two-factor-authentication`), https://wordpress.org/plugins/two-factor-authentication/
- **Affected versions:** from 1.2.12 before 1.17.0
- **Fixed in:** 1.17.0 (Update to 1.17.0 or later.)
- **Severity:** Medium 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/two-factor-authentication
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1740/

## Description

The Two Factor Authentication plugin for WordPress is vulnerable to a two-factor authentication bypass via the 'creds_user_id' login parameter in all versions up to, and including, 1.16.0. This is due to the login handler taking a 'creds_user_id' value from the POST request, which was meant to be set only by the 'simbatfa_auth_user_from_login_params' filter, and using it to choose which account's TFA code is checked. This makes it possible for authenticated attackers, with subscriber-level access and above, who have TFA enabled on their own account, to log into another user's account with their own TFA code instead of the victim's. The attacker must already know the target account's password.

## References

- https://wpsec.com/vuln/WPSEC-2026-1740/
- https://plugins.svn.wordpress.org/two-factor-authentication/tags/1.17.0/
- https://wordpress.org/plugins/two-factor-authentication/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1740/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.