Google Authenticator <= 0.47 - Two Factor Authentication Bypass

Description

WordPress 4.5 introduced the ability to login with an email address instead of a username. Google Authenticator v0.47 wasn't aware of the new feature, and didn't properly handle the case where an email address was used instead of a username. Using an email address would allow an attacker with a valid password to bypass the two-factor OTP.