Vulnerabilities / WP 2FA – Two-factor authentication for WordPress / WPSEC-2026-2587
WP 2FA – Two-factor authentication for WordPress <= 4.2.1 - Unauthenticated Authentication Bypass via Insufficient Passkey Origin Validation
Medium 6.8
CWE-346Fixed in 4.3.0
- ID
- WPSEC-2026-2587
- Plugin
- WP 2FA – Two-factor authentication for WordPress (wp-2fa)
- Affected
- from 3.1.0 before 4.3.0
- Remediation
- Update to 4.3.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- Weakness
- CWE-346
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- WP 2FA – Two-factor authentication for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The WP 2FA plugin for WordPress is vulnerable to Authentication Bypass via passkey (WebAuthn) sign-in in versions 3.1.0 up to, and including, 4.2.1. This is due to insufficient origin validation in Web_Authn::_check_origin(), which accepted client data from any subdomain of the relying party ID instead of requiring an exact match with the site's configured URLs. This makes it possible for unauthenticated attackers who control a subdomain of the site's host to relay a passkey assertion from a victim who is tricked into authenticating on that subdomain, and sign in as the victim.
References
- https://wpsec.com/vuln/WPSEC-2026-2587/
- https://plugins.svn.wordpress.org/wp-2fa/tags/4.3.0/
- https://wordpress.org/plugins/wp-2fa/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS