WP Security CheckVulnerability data as of October 17, 2026

Vulnerability alerts / October 14, 2026

Vulnerability in WP 2FA – Two-factor authentication for WordPress — CVE-2026-108066

LowSeverity
CVSS 2.7
0.3%Estimated exploit probability
EPSS
100,000+ sitesInstalls
4.2.0Fixed in

What to do now

Update WP 2FA – Two-factor authentication for WordPress to 4.2.0 or later.

Affected versions

  • Everything before 4.2.0

Affected: WP 2FA – Two-factor authentication for WordPress (plugin, wp-2fa)

Check: The plugin on wordpress.org / Our record for WP 2FA – Two-factor authentication for WordPress

What the vulnerability is

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to 4.2.0. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with administrator-level access and above, to perform an unauthorized action.

This description is reproduced verbatim from the public vulnerability record.

Sources

Part of this record comes from Wordfence Intelligence. Original: https://www.wordfence.com/threat-intel/vulnerabilities/id/2f9a783a-8495-4410-b350-4b8299880a64
Copyright 2012-2026 Defiant Inc. / Full license text

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.

See other alerts