CVE-2023-6272 Theme My Login 2FA < 1.2 - Lack of Rate Limiting

2023-12-1820:07:55

WPScan

www.cve.org

theme my login

wordpress

2fa

rate limiting

cve-2023-6272

brute-force

6 digits

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

JSON

The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn’t be too long, as the 2FA codes are 6 digits.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "tml-2fa",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "1.2"
      }
    ],
    "defaultStatus": "unaffected"
  }
]