CVE-2026-108066

Deferred Deferred - Pending Action

Authentication Bypass in WP 2FA WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: WPScan

Description

The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108066

EUVD

EUVD-2026-100849

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	WP	2FA 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

The WP 2FA WordPress plugin before version 4.2.0 has an Insecure Direct Object Reference (IDOR) flaw. This allows site administrators on WordPress Multisite to remove two-factor authentication (2FA) configurations for users outside their own site, including accounts they are not permitted to edit. On single-site setups, administrators already manage all users, so the issue primarily affects Multisite installations by crossing trust boundaries.

Detection Guidance

Check the installed version of the WP 2FA plugin. If it is below 4.2.0, the system is vulnerable. Use WordPress admin panel or run: wp plugin list --name=wp-2fa to verify the version.

Impact Analysis

If you use WordPress Multisite with the WP 2FA plugin before version 4.2.0, an administrator on one site could remove 2FA for users on other sites, potentially locking them out of their accounts. This could lead to unauthorized access or disruption of user accounts.

Compliance Impact

This vulnerability primarily affects WordPress Multisite environments by allowing administrators to remove 2FA configurations for users outside their permitted scope. While it does not directly impact GDPR or HIPAA compliance, it could indirectly contribute to compliance risks by weakening authentication controls, which are critical for protecting sensitive user data under these regulations.

Mitigation Strategies

Update the WP 2FA plugin to version 4.2.0 or later immediately. If using WordPress Multisite, restrict administrator privileges to prevent unauthorized access across sites.

Hi! I’m here to help you understand CVE-2026-108066. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70