PT-2026-20601 · WordPress · Two Factor (2Fa) Authentication Via Email

Ulyses Saicha · Publicado 2026-02-19 · Atualizado 2026-02-23 · CVE-2025-13587

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Two Factor (2FA) Authentication via Email plugin for WordPress versions up to and including 1.9.8

Description The Two Factor (2FA) Authentication via Email plugin for WordPress is susceptible to a bypass of the two-factor authentication mechanism. The SS88 2FAVE::wp login() function only enforces 2FA if the token HTTP GET parameter is not defined. This allows an attacker to bypass 2FA by providing any value, including an empty one, in the token parameter during login.

Recommendations Update the Two Factor (2FA) Authentication via Email plugin for WordPress to a version later than 1.9.8.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2025-13587

Produtos afetados

Two Factor (2Fa) Authentication Via Email

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-13587 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/11fbe76c-dc5c-413c-b6a8-d0f4aa56935d?source=cve · Nota
• https://twitter.com/CVEnew/status/2025892081286197428 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3408531%40two-factor-2fa-via-email&new=3408531%40two-factor-2fa-via-email&sfp_email=&sfph_mail= · Nota
• https://plugins.trac.wordpress.org/browser/two-factor-2fa-via-email/trunk/ss88-two-factor-via-email.php#L218 · Nota