Executive brief
UsersWP, a WordPress plugin used for managing user profiles and directories, contains a security flaw in its two-factor authentication (2FA) system. If an attacker already knows a user's password, they can exploit this vulnerability to skip the second security step and gain full access to the account. This bypass undermines the additional security layer intended to protect sensitive user accounts from unauthorized access.
Technical details
An authentication bypass vulnerability exists in the UsersWP plugin for WordPress due to improper validation within the two-factor authentication (2FA) login handler. The root cause is the plugin's failure to verify the selected authentication provider during the 2FA challenge phase. An attacker who has already obtained valid primary credentials (username and password) can exploit this by manipulating the login request to bypass the 2FA requirement entirely. This allows for unauthorized account takeover of users who have 2FA enabled. The issue is resolved in version 1.2.67.
Affected products
- UsersWP UsersWP < 1.2.67
Timeline
- 2026-07-08: disclosed
- 2026-07-08: patched: Fixed in version 1.2.67
- 2026-07-29: advisory