WordPress Plugin Vulnerabilities

WP 2FA < 2.2.0 - Arbitrary 2FA Disabling via IDOR

Description

The plugin does not properly check for authorisation when disabling 2FA, allowing users to disable the protection of other users via an IDOR attack

Affects Plugins

Plugin icon
wp-2fa
Fixed in 2.2.0

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Maycon Vitali
Verified
Yes
WPVDB ID
5f7aa2b7-28f9-4ddd-9ec8-b370e545bd1b

Timeline

Publicly Published
2022-04-14 (about 3 years ago)
Added
2022-04-29 (about 3 years ago)
Last Updated
2022-04-29 (about 3 years ago)

Other

Published
Title
Published
2024-03-28
Title
ProfileGrid < 5.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2023-11-23
Title
Accept Stripe Payments < 2.0.80 - Insecure Direct Object Reference
Published
2025-06-26
Title
Mollie Payments for WooCommerce < 8.0.3 - Unauthenticated Insecure Direct Object Reference
Published
2025-11-17
Title
Post Type Switcher < 4.0.1 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change
Published
2023-08-30
Title
Metform Elementor Contact Form Builder < 3.3.2 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode