plugin
22 known security issues reported for the Wp 2Fa WordPress plugin. Most recent disclosed Jun 23, 2026.
Running Wp 2Fa on your site? Check whether your installed version is affected.
Scan your site freeThe WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to accoutn takeover in all versions up to, and including, 3.1.1.1. This is due to the plugin not properly verifying an email during 2FA enrollment. This makes it possible for authenticated attackers, with subscriber-level access and...
[en] The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to 2FA bypass in all versions up to, and including, 2.9.3. This makes it possible for unauthenticated attackers to bypass 2FA protection. Please note Wordfence does not consider this a security vulnerability and previously rejected...
[en] Insertion of Sensitive Information into Log File vulnerability in WP 2FA allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP 2FA: from n/a through 2.6.3.
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.3 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the expose...
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP 2FA allows Reflected XSS.This issue affects WP 2FA: from n/a through 2.6.2.
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...
[en] Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0.
[en] The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the send_backup_codes_email function. This makes it possible for unauthenticated attackers to se...
[en] The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email...
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email arbit...
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the send_backup_codes_email function. This makes it possible for unauthenticated attackers to send em...
The WP 2FA plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the login_form_validate_2fa function in versions up to, and including, 2.2.0. This makes it possible for authenticated attackers to receive a 2fa login code even if the provider is not enabled for that user.
[en] The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.
The WP 2FA plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.2.1 due to the use of a linear-time comparison operator when comparing token hashes. This allows an attacker to gain information about authentication tokens by observing small time differences in server r...
[en] The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
The WP 2FA WordPress plugin before 2.2.1 does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue.
Arbitrary 2FA Disabling via Insecure Direct Object References (IDOR) vulnerability discovered by Maycon Vitali in WordPress WP 2FA plugin (versions <= 2.1.0).
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress make it possible for attackers to disable other user's 2FA settings in versions up to, and including, 2.1.0.
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress make it possible for attackers to disable other user's 2FA settings in versions up to, and including, 2.1.0.
The plugin does not properly check for authorisation when disabling 2FA, allowing users to disable the protection of other users via an IDOR attack
Update the WordPress WP 2FA plugin to the latest available version (at least 2.2.1). Calvin Alkan discovered and reported this Broken Authentication vulnerability in WordPress WP 2FA Plugin. This can be abused by a malicious actor to perform action which normally should only be able to be executed by higher privileged...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free