CVE-2026-11883 WebAuthn Provider for Two Factor < 2.5.6 - 2FA Bypass
Attackers with valid passwords can bypass two-factor authentication in the WebAuthn Provider plugin by submitting malformed requests.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11883?
CVE-2026-11883 is a high-severity authentication bypass vulnerability in Unknown WebAuthn Provider for Two Factor, published on 1 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request.
Which versions are affected by CVE-2026-11883?
How do I fix CVE-2026-11883?
No fix has been published for CVE-2026-11883 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-11883 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-11883 exists.
Sources
Also known as GHSA-758r-7wwh-v6r7.