CVE-2026-103514

Summary

The WP 2FA WordPress plugin fails to invalidate used time-based one-time passcodes, allowing attackers to replay valid codes and bypass two-factor authentication. This creates a persistent backdoor for authenticated users to gain unauthorized access to administrator accounts.

Exploitability

Exploitation requires an attacker to know a user's password and observe a valid TOTP code within its validity window, making it moderately difficult but possible with a bit of reconnaissance and observation.

Blast radius

The vulnerability could allow attackers to compromise administrator accounts across multiple sites using the vulnerable plugin, potentially leading to full system takeover and persistent access.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to WP 2FA plugin version 4.1.0 or later to receive the fix for time-based passcode replay vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.