The WP 2FA WordPress plugin before version 4.2.0 fails to perform an object‑level capability check when a user’s two‑factor authentication configuration is removed. This missing check allows an administrator with site‑admin rights on a WordPress Multisite network to delete or reset the 2FA settings of users belonging to sites outside the administrator’s own site, effectively eliminating that user’s second‑factor protection.

This vulnerability affects installations of the WP 2FA plugin older than version 4.2.0 that run on a WordPress Multisite environment. Site‑admins who have the capability to manage users on their own subsites can exploit the flaw to modify 2FA settings for accounts on other subsites within the network. On single‑site WordPress deployments the flaw is not exploitable because administrators already have authority over all users.

The CVSS score of 2.7 indicates a low severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation. Not listed in CISA KEV, the vulnerability has not been reported as widely exploited. An attacker only needs authenticated site‑admin privileges on a Multisite deployment and can use the normal 2FA removal interface to remove other users’ MFA settings. No remote code execution or additional privileges are required; the attack vector is limited to authenticated use of the plugin’s user‑management interface.