CVE-2026-15372: WP 2FA Auth Bypass Vulnerability

CVE-2026-15372 Overview

CVE-2026-15372 is an authentication bypass vulnerability in the WP 2FA WordPress plugin before version 4.1.0. The plugin fails to validate the second authentication factor when one of its supported methods is selected at login. An attacker who already knows a user's password can bypass two-factor authentication (2FA) and access the account, including administrator accounts. The flaw is categorized as [CWE-287] Improper Authentication. It affects a security control designed specifically to prevent account takeover after password compromise.

Critical Impact
Attackers with valid credentials can bypass 2FA entirely and gain full account access, including WordPress administrator accounts, defeating the plugin's core protection.

Affected Products

WP 2FA WordPress plugin versions prior to 4.1.0
WordPress sites using WP 2FA for two-factor enforcement
Administrator, editor, and subscriber accounts protected by the plugin

Discovery Timeline

2026-08-05 - CVE-2026-15372 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-15372

Vulnerability Analysis

The WP 2FA plugin adds a second authentication step to the standard WordPress login flow. When a user submits their username and password, the plugin should challenge them to provide a valid one-time code or push confirmation before establishing a session. In versions prior to 4.1.0, the plugin does not validate the submitted second factor when specific supported methods are selected during login. The authentication flow proceeds as if the second factor was verified. This converts the 2FA control into a decorative step that does not gate session issuance.

The result is a complete defeat of the plugin's security promise. Any credential exposed through phishing, credential stuffing, password reuse, or database breach becomes directly usable against sites relying on WP 2FA. Administrator accounts are equally exposed, allowing full site takeover, plugin installation, and content manipulation.

Root Cause

The root cause is missing server-side validation of the second-factor response for one or more supported 2FA methods. The plugin trusts client-side selection or state without cryptographically verifying the challenge response before completing authentication. This is a classic [CWE-287] Improper Authentication defect where a required verification step is absent from the authentication decision.

Attack Vector

Exploitation requires network access to the WordPress login endpoint and prior knowledge of a valid username and password. No user interaction is required from the victim. The attacker interacts with the login form, selects the vulnerable 2FA method, and submits the request. The plugin issues a session without verifying the second factor. The attack is remote, low-complexity, and requires no elevated privileges.

The vulnerability mechanism is described in the WPScan Vulnerability Report. No verified public exploit code is currently referenced in the CVE data.

Detection Methods for CVE-2026-15372

Indicators of Compromise

Successful WordPress logins from unusual IP addresses or geolocations without corresponding 2FA challenge log entries
New administrator accounts, plugin installations, or theme edits following a login event
WP 2FA plugin version reported below 4.1.0 in the WordPress admin dashboard
Absence of second-factor verification records in plugin audit logs despite successful authentication

Detection Strategies

Inventory all WordPress sites and query the WP 2FA plugin version against the fixed version 4.1.0 or later
Correlate wp-login.php POST requests with WP 2FA challenge and verification records to identify sessions established without a completed second factor
Monitor WordPress authentication logs for administrator logins that lack a matching 2FA success entry

Monitoring Recommendations

Forward WordPress and WP 2FA audit logs to a centralized logging platform for cross-session correlation
Alert on privilege changes, new administrator creation, and plugin or theme file modifications following any login event
Track failed-then-successful login sequences on the same account to detect credential-stuffing patterns targeting the bypass

How to Mitigate CVE-2026-15372

Immediate Actions Required

Update the WP 2FA plugin to version 4.1.0 or later on every WordPress site in scope
Force a password reset for all administrator and privileged accounts on affected sites
Review recent login and audit events for signs of unauthorized administrator access
Rotate any API keys, application passwords, or integration tokens issued by potentially compromised accounts

Patch Information

Upgrade WP 2FA to version 4.1.0 or later. This release restores server-side validation of the second authentication factor for the affected methods. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily disable the WP 2FA plugin and enforce strong, unique passwords combined with IP-based access restrictions on wp-login.php until the patch is applied
Restrict administrator login to allowlisted IP ranges or a VPN gateway via web server or WAF rules
Enforce rate limiting on wp-login.php to slow credential-based attacks against the bypass
Require re-authentication for sensitive actions such as plugin installation and user role changes

bash

# Configuration example: restrict wp-login.php to trusted IPs (nginx)
location = /wp-login.php {
    allow 203.0.113.0/24;
    deny all;
    include fastcgi_params;
    fastcgi_pass php-fpm;
}