Plugin icon

WP 2FA – Two-factor authentication for WordPress

wp-2fa

Vulnerabilities:

8

Last Updated:

March 16, 2026

Active Installs:

100000

Published
Title
Fixed in
CVSS
Published
2025-11-03
Title
WP 2FA < 3.0.0 - Second Factor Bypass
Fixed in
Fixed in 3.0.0
CVSS
4.8 (medium)
Published
2024-06-20
Title
WP 2FA < 2.6.4 - Unauthenticated Information Exposure via Log File
Fixed in
Fixed in 2.6.4
CVSS
5.3 (medium)
Published
2024-04-16
Title
WP 2FA – Two-factor authentication for WordPress < 2.6.3 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.6.3
CVSS
6.1 (medium)
Published
2024-01-02
Title
WP 2FA < 2.6.0 - Subscriber+ Arbitrary Email Sending
Fixed in
Fixed in 2.6.0
CVSS
4.3 (medium)
Published
2024-01-02
Title
WP 2FA < 2.6.0 - Arbitrary Email Sending via CSRF
Fixed in
Fixed in 2.6.0
CVSS
4.3 (medium)
Published
2022-09-14
Title
WP 2FA < 2.3.0 - Time-Based Side-Channel Attack
Fixed in
Fixed in 2.3.0
CVSS
4.8 (medium)
Published
2022-05-06
Title
WP 2FA < 2.2.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.2.1
CVSS
6.1 (medium)
Published
2022-04-14
Title
WP 2FA < 2.2.0 - Arbitrary 2FA Disabling via IDOR
Fixed in
Fixed in 2.2.0
CVSS
4.3 (medium)