CVE-2026-15372 WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider
Attackers with valid passwords can bypass two-factor authentication in WP 2FA to fully access user accounts, including administrators.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15372?
CVE-2026-15372 is a high-severity authentication bypass vulnerability in Unknown WP 2FA, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.
Weakness: CWE-287
Which versions are affected by CVE-2026-15372?
How do I fix CVE-2026-15372?
No fix has been published for CVE-2026-15372 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-15372 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-15372 exists.
Sources
Also known as GHSA-r795-xx32-3hg7.