The WordPress Two Factor (2FA) Authentication via Email plugin fails to enforce the second factor when the HTTP GET parameter ‘token’ is present, even if it is empty. This flaw, based on improper input validation (CWE‑20), enables an attacker to log in without completing the two‑factor step. A successful bypass undermines account security and grants an attacker unauthorized access to any account credentials that reach the login endpoint.

Users of the Two Factor (2FA) Authentication via Email WordPress plugin from ss88_uk, versions 1.9.8 and earlier, are affected. No other vendors or products are listed.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1 % suggests a low likelihood of widespread exploitation at present, and the vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a ‘token’ value during login, which most current login implementations do not reject. If the vulnerable plugin is enabled, credential holders can be compromised with this simple parameter manipulation.