CVE-2025-13587
Two Factor (2FA) Authentication via Email <= 1.9.8 - Two-Factor Authentication Bypass via token
mediumImproper Input Validation
6.5
CVSS Score
6.5
CVSS Score
medium
Severity
1.9.9
Patched in
1d
Time to patch
Description
The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. This is because the SS88_2FAVE::wp_login() method only enforces the 2FA requirement if the 'token' HTTP GET parameter is undefined, which makes it possible to bypass two-factor authentication by supplying any value in the 'token' parameter during login, including an empty one.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NAttack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
None
Confidentiality
High
Integrity
None
Availability
Technical Details
Affected versions
<=1.9.8PublishedFebruary 18, 2026
Last updatedFebruary 19, 2026
Affected plugintwo-factor-2fa-via-email
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.