Two Factor (2FA) Authentication via Email < 1.9.9 - Two-Factor Authentication Bypass via token

Description

The plugin is vulnerable to Two-Factor Authentication Bypass due to the SS88_2FAVE::wp_login() method only enforcing the 2FA requirement if the 'token' HTTP GET parameter is undefined, which makes it possible to bypass two-factor authentication by supplying any value in the 'token' parameter during login, including an empty one.