CVE-2026-11883

HIGH CVSS 7.2 View on NVD ↗

Description

The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/f718390c-1d7c-4048-bce6-a3170998e828/

Published: Jul 01, 2026 07:16 UTC Modified: Jul 01, 2026 18:17 UTC