Two Factor (2FA) Authentication via Email <= 1.9.8 - Two-Factor Authentication Bypass via token
Strategic Overview
- Status
- Patched in 1.9.9
- Affected Plugin
- Two Factor (2FA) Authentication via Email
- Affected Version
<= 1.9.8- CVSS
- 6.5Medium
- Weakness type
- CWE-20 · Improper Input Validation
- CVE
CVE-2025-13587
At a glance
CVE-2025-13587 is a medium-severity Improper Input Validation vulnerability in the Two Factor (2FA) Authentication via Email WordPress plugin, affecting versions <= 1.9.8. It carries a CVSS score of 6.5 (reachable over the network; low attack complexity; high integrity impact). The issue is fixed in version 1.9.9; sites on affected versions should update now. Disclosed February 2026, reported by Ulyses Saicha.
Vulnerability Overview
The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. This is because the SS88_2FAVE::wp_login() method only enforces the 2FA requirement if the 'token' HTTP GET parameter is undefined, which makes it possible to bypass two-factor authentication by supplying any value in the 'token' parameter during login, including an empty one.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user. A successful exploit has high impact on integrity.
CWE-20: Improper Input Validation
Two Factor (2FA) Authentication via Email <= 1.9.8 carries this weakness at token, and reaching it takes a caller who can reach the endpoint. Improper input validation means the application accepts input without confirming it has the form, type or range the code downstream assumes.
The concrete impact depends on where the unvalidated value lands, which is why records in this class range from cosmetic bugs to full compromise. For Two Factor (2FA) Authentication via Email the fix is 1.9.9: builds <= 1.9.8 are affected, anything from 1.9.9 onward is not.
Remediation
Update to version 1.9.9, or a newer patched version
How does WordSec protect against this?
The attempt arrives as an ordinary request to Two Factor (2FA) Authentication via Email: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: Two Factor (2FA) Authentication via Email 1.9.9 closes this, and updating the plugin is the step that ends it.
- Firewall
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C