CVE-2026-15372

The WP 2FA WordPress plugin before version 4.1.0 does not validate the second authentication factor when a supported method is selected at login. This allows someone who already knows a user’s password to bypass two‑factor authentication and fully access the account, including administrator accou...