Technical impact
The vulnerability allows an unauthenticated attacker to trigger a denial of service by sending crafted requests or flooding the WordPress Two Factor plugin, leading to resource exhaustion and making the website unavailable to legitimate users. This weakness is consistent with resource exhaustion (CWE-770).
Affected Systems
The issue affects the WordPress Two Factor plugin from WordPress.org for versions 0.16.0 and earlier. No patch is applied beyond upgrading the plugin itself.
Risk and Exploitability
The CVSS base score is 5.3, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the attack is unauthenticated and relies on resource exhaustion, an attacker can execute it from any machine without valid credentials, potentially crippling the website. The lack of an exploit probability score suggests low-to-moderate likelihood of exploitation in the wild, but the availability of the plugin makes it a reasonable target for automated DoS attempts.
