# WP 2FA – Two-factor authentication for WordPress <= 4.2.1 - Unauthenticated Authentication Bypass via Insufficient Passkey Origin Validation

- **ID:** WPSEC-2026-2587
- **Plugin:** WP 2FA – Two-factor authentication for WordPress (`wp-2fa`), https://wordpress.org/plugins/wp-2fa/
- **Affected versions:** from 3.1.0 before 4.3.0
- **Fixed in:** 4.3.0 (Update to 4.3.0 or later.)
- **Severity:** Medium 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-346
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-2fa
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2587/

## Description

The WP 2FA plugin for WordPress is vulnerable to Authentication Bypass via passkey (WebAuthn) sign-in in versions 3.1.0 up to, and including, 4.2.1. This is due to insufficient origin validation in Web_Authn::_check_origin(), which accepted client data from any subdomain of the relying party ID instead of requiring an exact match with the site's configured URLs. This makes it possible for unauthenticated attackers who control a subdomain of the site's host to relay a passkey assertion from a victim who is tricked into authenticating on that subdomain, and sign in as the victim.

## References

- https://wpsec.com/vuln/WPSEC-2026-2587/
- https://plugins.svn.wordpress.org/wp-2fa/tags/4.3.0/
- https://wordpress.org/plugins/wp-2fa/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2587/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.