PT-2024-14983

Name of the Vulnerable Software and Affected Versions WP 2FA – Two-factor authentication for WordPress plugin versions up to, and including, 2.5.0 Description The issue is related to Insecure Direct Object Reference. It affects the send backup codes email function due to missing validation on a...

CVE-2023-6506: Authorization Bypass Through User-Controlled Key

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the sendbackupcodesemail due to missing validation on a user controlled key. This makes it possible for subscriber-level...