WP 2FA <= 3.1.1.1 - Authenticated (Subscriber+) Account Takeover
2026-06-23 00:00
JangerStrategic Overview
StatusPatched in 3.1.1.2
Affected PluginWP 2FA – Two-factor authentication for WordPress
Affected Version
<= 3.1.1.1CVSS4.3Medium
CVE
CVE-2026-12988Vulnerability Overview
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to accoutn takeover in all versions up to, and including, 3.1.1.1. This is due to the plugin not properly verifying an email during 2FA enrollment. This makes it possible for authenticated attackers, with subscriber-level access and above, to complete verification for other users gaining access to their account.
Technical Analysis
REMEDIATION: Update to version 3.1.1.2, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C