CVE-2026-108066

The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts the...

CVE-2026-108066

The WP 2FA WordPress plugin, in versions prior to 4.2.0 , is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to perform an object-level capability check when removing a user's two-factor authentication configuration. This allows a site administrator on a WordPress ...