Wp 2fa

wp_2fa

Vendor: Melapress • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-44587 1Melapress 1Wp 2fa Nov 21, 2024 Jun 21, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 Insertion of Sensitive Information into Log File vulnerability in WP 2FA allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP 2FA: from n/a through 2.6.3.
CVE-2024-32568 1Melapress 1Wp 2fa Apr 23, 2026 Apr 18, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP 2FA wp-2fa.This issue affects WP 2FA: from n/a through <= 2.6.2.
CVE-2022-44595 1Melapress 1Wp 2fa Apr 28, 2026 Mar 21, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0.
CVE-2023-6520 1Melapress 1Wp 2fa Apr 8, 2026 Jan 11, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on t...Show more The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the send_backup_codes_email function. This makes it possible for unauthenticated attackers to send emails with arbitrary content to registered users via a forged request granted they can trick a site administrator or other registered user into performing an action such as clicking on a link. While a nonce check is present, it is only executed if a nonce is set. By omitting a nonce from the request, the check can be bypassed.Show less