Description
The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP 2FA | < 3.1.1.2 | 3.1.1.2 |
References
- https://wpscan.com/vulnerability/8aa6bf91-54ee-4326-a477-31f42284be22/ exploit vdb-entry technical-description