WordPress Plugin Vulnerabilities

UsersWP < 1.2.67 - Two-Factor Authentication Bypass

Description

The plugin does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.

Proof of Concept

Affects Plugins

Plugin icon
userswp
Fixed in 1.2.67

References

CVE
CVE-2026-13690

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
7.1 (high)

Miscellaneous

Original Researcher
dc11
Submitter
dc11
Verified
Yes
WPVDB ID
144202a9-e86f-4977-a97a-eca673859c81

Timeline

Publicly Published
2026-07-08 (about 18 days ago)
Added
2026-07-08 (about 18 days ago)
Last Updated
2026-07-08 (about 18 days ago)

Other

Published
Title
Published
2016-12-23
Title
BuddyPress 2.0-2.7.3 - Arbitrary File Deletion
Published
2026-05-04
Title
MoreConvert Pro < 1.9.15 - Authentication Bypass via Waitlist Guest Verification Token Reuse
Published
2015-03-21
Title
WP Marketplace <= 2.4.0 - Arbitrary File Download
Published
2023-06-04
Title
WP User Switch < 1.0.3 - Subscriber+ Authentication Bypass
Published
2017-12-03
Title
Apocalypse Meow 21.1.3-21.2.7 - BCrypt Authentication Bypass