CVE-2026-15372

Summary

The WP 2FA plugin before version 4.1.0 fails to validate the second authentication factor, allowing attackers with knowledge of a user's password to bypass two-factor authentication and gain full access to the account.

Exploitability

Exploitation is relatively easy for attackers who have obtained or guessed a user’s password, as no additional factors are validated during login.

Blast radius

If exploited, this flaw could lead to unauthorized access to user accounts, including administrator accounts, potentially compromising sensitive data and system integrity.

Prioritized remediation

Update the WP 2FA plugin to version 4.1.0 or later to ensure proper validation of second authentication factors.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.