CVE-2026-108066
WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR
Unknown WP 2FA
CVSS
2.7LowExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.2.0WP 2FACVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
Text from CVE List
Affected versions 1
- WP 2FAaffected: all versions before 4.2.0CVE List