CVE-2025-10293 Overview
CVE-2025-10293 is a privilege escalation vulnerability in the Keyy Two Factor Authentication (like Clef) plugin for WordPress, affecting all versions up to and including 1.2.3. The flaw resides in the plugin's token validation logic, which fails to properly verify that a generated authentication token belongs to the requesting user. Authenticated attackers with subscriber-level access can generate valid auth tokens and use them to log in as other accounts, including administrators that have 2FA configured. The vulnerability is categorized under CWE-287: Improper Authentication.
Critical Impact
A subscriber-level attacker can take over administrator accounts with 2FA enabled, leading to full compromise of the WordPress site.
Affected Products
- Keyy Two Factor Authentication (like Clef) WordPress plugin versions ≤ 1.2.3
- WordPress sites with the Keyy plugin active and 2FA configured for privileged accounts
- Any administrator account on affected sites that has set up Keyy 2FA
Discovery Timeline
- 2025-10-15 - CVE-2025-10293 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-10293
Vulnerability Analysis
The Keyy plugin provides a token-based two-factor authentication flow modeled after the Clef system. During authentication, the plugin issues an auth token that is later exchanged to complete the login process. The plugin does not bind the issued token to the identity of the user requesting it, allowing any authenticated session to obtain a token usable against other accounts.
An attacker with subscriber-level access, the lowest authenticated role in WordPress, can generate a valid token and then submit it through the login completion flow targeting an administrator account. Because the plugin trusts the token without re-validating ownership, the request succeeds and establishes an authenticated session as the targeted user. Successful exploitation yields complete confidentiality, integrity, and availability impact on the WordPress installation.
Root Cause
The root cause is improper authentication ([CWE-287]). The token issuance and validation paths omit a check that ties the token to the user account it was generated for. Authorization is therefore decided based on possession of any valid token rather than on a verified user-to-token binding.
Attack Vector
Exploitation is performed over the network against the WordPress login endpoints exposed by the Keyy plugin. The attacker first authenticates with valid subscriber credentials, then interacts with the plugin's token endpoints to mint a token, and finally completes the login flow specifying a target administrator account. No user interaction from the victim is required, and the attack succeeds as long as the targeted administrator has Keyy 2FA configured. Refer to the Wordfence Vulnerability Report for further technical context.
Detection Methods for CVE-2025-10293
Indicators of Compromise
- Successful administrator logins immediately following Keyy token generation requests from low-privileged accounts
- Authentication events showing a session transitioning from a subscriber user to an administrator without a password reset
- Unexpected administrative actions such as plugin installations, user role changes, or option modifications by recently logged-in admin accounts
Detection Strategies
- Audit WordPress access logs for repeated requests to Keyy plugin endpoints originating from subscriber-level accounts
- Correlate Keyy token issuance events with subsequent administrator login events from the same IP address or user agent
- Monitor the wp_users and wp_usermeta tables for unauthorized changes to administrator accounts following anomalous logins
Monitoring Recommendations
- Enable verbose authentication logging in WordPress and forward logs to a centralized SIEM for correlation
- Alert on any privilege change events where a subscriber account is followed by an administrator session within a short time window
- Track plugin file integrity and configuration changes that may indicate post-compromise persistence
How to Mitigate CVE-2025-10293
Immediate Actions Required
- Deactivate the Keyy Two Factor Authentication plugin on all WordPress sites until a patched version is confirmed installed
- Force password resets and re-enroll 2FA for all administrator accounts that had Keyy 2FA configured
- Review user lists for unauthorized accounts and audit recent administrator activity for signs of takeover
Patch Information
At the time of publication, the NVD entry lists affected versions up to and including 1.2.3 and does not specify a fixed version. Site operators should check the Keyy plugin page on WordPress.org and the Wordfence Vulnerability Report for updates and apply any released patch immediately.
Workarounds
- Remove the Keyy plugin entirely and replace it with an alternative two-factor authentication solution that binds tokens to user identity
- Restrict subscriber registration by disabling open user registration in WordPress general settings until the plugin is patched or removed
- Place the WordPress login and admin endpoints behind a web application firewall (WAF) with rules that block anomalous Keyy token request patterns
# Disable the Keyy plugin from the command line using WP-CLI
wp plugin deactivate keyy
wp plugin delete keyy
# Disable open user registration as a defense-in-depth measure
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
