CVE-2026-108066
CVE-2026-108066 · WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
CVSS 2.7 · Low · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
wp 2fa
- Versions
- ≥ 0, < 4.2.0: Affected (semver)
Update to 4.2.0