CVE-2026-15372: WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider
Published Aug 5, 2026
·Updated
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.
Affected Software
1 affected component
wordpress/wp-2fa<4.1.0
Event History
Aug 5, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:16 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2026-15372?
CVE-2026-15372 has a severity score of 76.
2
How do I fix CVE-2026-15372?
To fix CVE-2026-15372, upgrade the WP 2FA plugin to version 4.1.0 or later.
3
What does CVE-2026-15372 affect?
CVE-2026-15372 affects the WP 2FA WordPress plugin versions prior to 4.1.0.
4
What is the impact of CVE-2026-15372?
The impact of CVE-2026-15372 is that an attacker can bypass two-factor authentication if they know the user's password.
5
When was CVE-2026-15372 published?
CVE-2026-15372 was published on August 5, 2026.