CVE-2026-103514 in WP 2FA Plugin
Summary
by MITRE • 10/03/2026
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in the WP 2FA WordPress plugin prior to version 4.1.0 represents a critical failure in the implementation of time-based one-time password protocols, specifically violating the fundamental requirement that each generated code must be used only once. This flaw allows an attacker who has compromised a user's static password and possesses knowledge of a valid, recently issued two-factor authentication code within its validity window to replay that specific code during subsequent login attempts. By reusing this previously observed token, the attacker can successfully bypass the multi-layered security controls intended to protect administrative accounts and other sensitive user profiles on WordPress installations running affected versions of the plugin.
From a technical perspective, the root cause lies in the absence of state management for consumed authentication tokens within the application logic. In secure implementations of two-factor authentication systems, once a time-based one-time passcode is validated against the server's expected value, it must be immediately marked as invalid or deleted from any temporary storage to prevent reuse. The vulnerability stems from the plugin failing to update this internal state after successful validation, thereby leaving the token active and usable for an indefinite period within its temporal validity window. This oversight effectively reduces the security posture of two-factor authentication back to that of single-factor authentication when combined with password theft or observation attacks such as shoulder surfing or keylogging.
The operational impact of this vulnerability is severe, particularly given the prevalence of WordPress in hosting administrative interfaces and content management systems where privilege escalation can lead to full site compromise. An attacker leveraging this flaw does not need to break cryptographic algorithms or guess new codes; they merely need to intercept a valid code during its active window and replay it at their convenience within that timeframe. This significantly lowers the barrier for entry, enabling unauthorized access to administrator accounts which typically possess unrestricted control over website content, user management, plugin installation, and server configuration files. Consequently, this can lead to data exfiltration, defacement, malware injection, or further lateral movement into connected backend systems.
This vulnerability aligns with CWE-294, which describes the acceptance of a capture replay attack as a valid authentication request, indicating that the system fails to properly track and reject previously used credentials. Furthermore, it relates to CWE-613, insufficient session expiration, although in this context, the session token or one-time code itself lacks proper lifecycle management rather than just session timeout settings. In terms of MITRE ATT&CK framework classification, this behavior facilitates Initial Access through Valid Accounts, specifically exploiting weaknesses in authentication mechanisms where replay attacks are possible due to improper state tracking.
To mitigate this risk, organizations running WordPress sites with the WP 2FA plugin must immediately upgrade to version 4.1.0 or later, which addresses the token invalidation logic flaw. Until an update is applied, administrators should consider disabling two-factor authentication if it cannot be updated promptly and relying on alternative security measures such as strong password policies, IP-based access restrictions for wp-admin paths, and Web Application Firewall rules that detect anomalous login patterns indicative of replay attempts. Additionally, implementing rate limiting on login endpoints can help reduce the effectiveness of brute-force or replay attacks by restricting the number of authentication attempts allowed within a specific time frame from any single source address.