{"id":"CVE-2026-103514","published":"2026-10-03T06:16:40.740","lastModified":"2026-10-06T15:18:12.170","description":"The WP 2FA  WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/e05aa5a3-cd04-428a-b6bb-0538ca1f6b4a/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WP 2FA WordPress plugin fails to invalidate used time-based one-time passcodes, allowing attackers to replay valid codes and bypass two-factor authentication. This creates a persistent backdoor for authenticated users to gain unauthorized access to administrator accounts.","exploitability":"Exploitation requires an attacker to know a user's password and observe a valid TOTP code within its validity window, making it moderately difficult but possible with a bit of reconnaissance and observation.","blast_radius":"The vulnerability could allow attackers to compromise administrator accounts across multiple sites using the vulnerable plugin, potentially leading to full system takeover and persistent access.","remediation":"Upgrade to WP 2FA plugin version 4.1.0 or later to receive the fix for time-based passcode replay vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","wp-plugin","2fa","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:01:35.889Z"}}