The UsersWP WordPress plugin before version 1.2.67 has an internal flaw where the two‑factor login handler fails to validate the chosen authentication provider. An attacker who already knows a user’s normal credentials can exploit this omission to skip the second factor and create a legitimate login session. This vulnerability is a type of authentication bypass (CWE‑287) that directly undermines user identity protection and could lead to unauthorized access to sensitive data or site administration if combined with other privileges.

The affected environment consists of WordPress sites that have the UsersWP plugin installed, any version prior to 1.2.67. The issue is limited to the plugin’s two‑factor authentication component and does not affect WordPress core or other plugins unless they share authentication flows.

The CVSS score of 7.4 indicates high potential impact if exploited, and the EPSS score of less than 1% suggests that the vulnerability is unlikely to be widely attacked at present. It is not listed in CISA’s KEV catalog, indicating no publicly known exploit. An attacker would need to know the victim’s credentials first; once those are known, they can simply request a two‑factor login and the plugin will accept the request without verifying the provider. The attack can be performed over the public HTTPS interface of the site and requires no special privileges beyond credential compromise.