PT-2026-20601 · WordPress · Two Factor (2Fa) Authentication Via Email

Ulyses Saicha · CVE-2025-13587 · Published 2026-02-19 · Updated 2026-02-23

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Two Factor (2FA) Authentication via Email plugin for WordPress versions up to and including 1.9.8

Description The Two Factor (2FA) Authentication via Email plugin for WordPress is susceptible to a bypass of the two-factor authentication mechanism. The SS88 2FAVE::wp login() function only enforces 2FA if the token HTTP GET parameter is not defined. This allows an attacker to bypass 2FA by providing any value, including an empty one, in the token parameter during login.

Recommendations Update the Two Factor (2FA) Authentication via Email plugin for WordPress to a version later than 1.9.8.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-13587

Affected Products

Two Factor (2Fa) Authentication Via Email

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-13587 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/11fbe76c-dc5c-413c-b6a8-d0f4aa56935d?source=cve · Note
• https://twitter.com/CVEnew/status/2025892081286197428 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3408531%40two-factor-2fa-via-email&new=3408531%40two-factor-2fa-via-email&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/two-factor-2fa-via-email/trunk/ss88-two-factor-via-email.php#L218 · Note