CVE-2022-1527

CVE-2022-1527 concerns the WP 2FA WordPress plugin prior to version 2.2.1. The vulnerability is a Reflected Cross-Site Scripting (XSS) caused by un-sanitized/untampered parameters being output back to an admin page. Affected component: WP 2FA plugin (WordPress). Root cause: improper sanitisation/...

CVE-2023-6506

The CVE-2023-6506 entry concerns the WP 2FA – Two-factor authentication for WordPress plugin. Affected: WP 2FA, versions up to and including 2.5.0. Issue: insecure direct object reference (IDOR) via send_backup_codes_email caused by missing validation on a user-controlled key, enabling subscriber...

CVE-2022-2891

The CVE-2022-2891 entry documents a time-based side-channel attack in the WP 2FA WordPress plugin prior to version 2.3.0. The vulnerability arises from comparison operators that do not mitigate timing differences, potentially leaking information about authentication codes during comparison. Affec...