WordPress Plugin Vulnerabilities

WP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Binding

Description

The plugin does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.

Proof of Concept

Affects Plugins

Plugin icon
wp-2fa
Fixed in 3.1.1.2

References

CVE
CVE-2026-12988
URL
https://janger.me/blog/post/Bypassing%202FA%20Account%20Takeover%20via%20Missing%20Authorization%20in%20WP%202FA%20Setup%20Wizard
YouTube Video
YouTube Video
YouTube Video

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Janger
Submitter
Janger
Submitter website
https://janger.me
Verified
Yes
WPVDB ID
8aa6bf91-54ee-4326-a477-31f42284be22

Timeline

Publicly Published
2026-06-23 (about 11 days ago)
Added
2026-06-23 (about 10 days ago)
Last Updated
2026-06-23 (about 10 days ago)

Other

Published
Title
Published
2023-11-28
Title
Button Generator < 2.3.9 - Unauthenticated Button Counter Reset
Published
2023-03-22
Title
W4 Post List < 2.4.6 - Subscriber+ Password Protected Post Content Disclosure
Published
2025-02-21
Title
Residential Address Detection < 2.5.5 - Unauthenticated Arbitrary Options Update
Published
2023-11-23
Title
Porto Theme - Functionality < 2.12.1 - Missing Authorization
Published
2025-11-22
Title
Custom Order Numbers for WooCommerce < 1.11.1 - Missing Authorization