PT-2025-47905 · WordPress · Wp 2Fa

Benjamin Nadarević · Published 2025-11-24 · Updated 2025-11-24 · CVE-2025-12628

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WP 2FA WordPress plugin versions prior to 3.0.0

Description The WP 2FA WordPress plugin generates backup codes with insufficient entropy. This allows attackers to bypass two-factor authentication by brute-forcing the backup codes, potentially leading to account takeover.

Recommendations Update to version 3.0.0 or later.

Exploit

Fix

Related Identifiers

CVE-2025-12628

Affected Products

Wp 2Fa

References · 8

• 🔥 https://wpscan.com/vulnerability/5e2d033c-dde6-4774-8588-cbe268c0d797 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12628 · Security Note
• https://twitter.com/CVEnew/status/1992953098281615601 · Twitter Post
• https://t.me/cveNotify/143769 · Telegram Post
• https://t.me/CVEtracker/38067 · Telegram Post
• https://twitter.com/VolerionSec/status/1992946142456234273 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1992956443171885126 · Twitter Post
• https://t.me/cveNotify/143815 · Telegram Post