CVE-2026-103514: WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay
Published Oct 3, 2026
·Updated
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.
Affected Software
1 affected component
WP White Security WP 2FA<4.1.0
Event History
Oct 3, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:16 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must know the target account's password and have observed a valid TOTP code while that code remains within its validity window. Administrator accounts are also affected.
2
Are installations running the fixed version affected?
No. The issue affects WP 2FA versions before 4.1.0.
3
What should be prioritized if patching cannot happen immediately?
Protect account passwords and prevent exposure of valid TOTP codes, since both are required for replay. Give particular priority to administrator accounts because they can also be bypassed.