WordPress WebAuthn Provider for Two Factor plugin < 2.5.6 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Volodymyr Kolesnykov in WordPress Plugin WebAuthn Provider for Two Factor versions 2.5.6...

CVE-2026-11883

The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request...

CVE-2026-11883

The WebAuthn Provider for Two Factor WordPress plugin versions before 2.5.6 contains a vulnerability where it fails to correctly validate the second-factor authentication response. This flaw allows an attacker who already possesses a user's password to bypass the two-factor authentication (2FA) r...

EUVD-2026-40920

The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request...

CVE-2026-11883: Undefined Security Weakness

The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request...