WP 2FA – Two-factor authentication for WordPress

WordPress plugin · wp-2fa · WordPress.org ↗

Latest v4.3.0 Last release Nov 4, 2026 Tested up to WP 7.1.4 100,000+ active installs

Critical

High

Known total

Unfixed

Running WP 2FA – Two-factor authentication for WordPress on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.5	WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay CVE.org	>=0, <4.1.0	v4.1.0	CVE-2026-103514	Oct 3, 2026
HIGH CVSS 8.8	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 4.2.0 WPVulnerability	< 4.2.0	v4.2.0	CVE-2026-62142	Oct 1, 2026
HIGH CVSS 7.5	WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider CVE.org	>=0, <4.1.0	v4.1.0	CVE-2026-15372	Aug 5, 2026
HIGH CVSS 7.1	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 2.6.3 WPVulnerability	< 2.6.3	v2.6.3	CVE-2024-32568	Apr 16, 2024
MEDIUM CVSS 6.4	WP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Binding CVE.org	>=0, <3.1.1.2	v3.1.1.2	CVE-2026-12988	Jul 14, 2026
MEDIUM CVSS 6.3	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 3.0.0 WPVulnerability · PoC available	< 3.0.0	v3.0.0	CVE-2025-12628	Nov 3, 2025
MEDIUM CVSS 5.3	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 2.6.4 WPVulnerability	< 2.6.4	v2.6.4	CVE-2022-44587	Jun 20, 2024
MEDIUM CVSS 4.3	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 2.6.0 WPVulnerability	< 2.6.0	v2.6.0	CVE-2023-6506	Jan 2, 2024
MEDIUM CVSS 4.3	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 2.6.0 WPVulnerability	< 2.6.0	v2.6.0	CVE-2023-6520	Jan 2, 2024
MEDIUM CVSS 5.3	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 2.2.1 WPVulnerability	< 2.2.1	v2.2.1	CVE-2022-44595	Dec 7, 2022
MEDIUM CVSS 5.9	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 2.3.0 WPVulnerability	< 2.3.0	v2.3.0	CVE-2022-2891	Sep 14, 2022
MEDIUM CVSS 6.1	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 2.2.1 WPVulnerability	< 2.2.1	v2.2.1	CVE-2022-1527	May 6, 2022
LOW CVSS 2.7	WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR CVE.org	>=0, <4.2.0	v4.2.0	CVE-2026-108066	Oct 14, 2026
UNKNOWN	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 4.2.0 WPVulnerability	< 4.2.0	v4.2.0	CVE-2026-108066	Oct 8, 2026
UNKNOWN	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 4.1.0 WPVulnerability	< 4.1.0	v4.1.0	CVE-2026-103514	Oct 3, 2026
UNKNOWN	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 4.1.0 WPVulnerability · PoC available	< 4.1.0	v4.1.0	CVE-2026-15372	Aug 5, 2026
UNKNOWN	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 3.1.1.2 WPVulnerability · PoC available	< 3.1.1.2	v3.1.1.2	CVE-2026-12988	Jun 23, 2026
UNKNOWN	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 2.2.0 WPVulnerability	< 2.2.0	v2.2.0	—	Apr 29, 2022
UNKNOWN	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 2.2.0 WPVulnerability	< 2.2.0	v2.2.0	—	Apr 13, 2022
UNKNOWN	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 2.2.0 WPVulnerability	< 2.2.0	v2.2.0	—	—
UNKNOWN	WP 2FA – Two-factor authentication for WordPress [wp-2fa] < 2.2.1 WPVulnerability	< 2.2.1	v2.2.1	—	—

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.