Executive brief
A vulnerability exists in a WordPress plugin used to provide secure WebAuthn-based two-factor authentication. If an attacker already knows a user's password, they can bypass the second security layer by sending a specially crafted request. This allows unauthorized access to user accounts even when two-factor authentication is enabled, potentially leading to full site compromise if an administrator account is targeted.
Technical details
An authentication bypass vulnerability exists in the WebAuthn Provider for Two Factor plugin for WordPress due to improper validation of the WebAuthn response. The flaw occurs when the plugin processes the second-factor authentication step; by submitting a malformed or 'null' value for the 'webauthn_response' parameter, the validation logic can be subverted. An attacker with valid primary credentials (username and password) can exploit this to gain full session access without a valid physical security key or biometric response. The issue is resolved in version 2.5.6.
Affected products
- Unknown WebAuthn Provider for Two Factor < 2.5.6
Timeline
- 2026-06-10: disclosed: Publicly published via WPScan
- 2026-06-10: patched: Fixed in version 2.5.6
- 2026-07-01: advisory: CVE published to NVD dataset