CVE-2026-108066
WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
| Vendor | unknown |
| Product | wp 2fa |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp 2fa
Be the first to know when new unknown vulnerabilities affecting unknown wp 2fa are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP 2FA
0 < 4.2.0
References
Credits
Muni Nitish Kumar Yaddala WPScan