https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:01:40 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-103514 <p>The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account&#39;s password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.</p> <p>The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account&#39;s password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-103514 https://vulnerability.circl.lu/vuln/ghsa-fh83-crgf-9w82 <p>The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account&#39;s password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.</p> <p>The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account&#39;s password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.</p> https://vulnerability.circl.lu/vuln/ghsa-fh83-crgf-9w82