CVE-2026-108066
Low
Description
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
SeverityLow
CVSS2.7
Exploit probability—
ProductWP 2FA
PublishedOct 14, 2026
First seenOct 14, 2026
How to fix
Update
- WP 2FA4.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WP 2FA | v < 4.2.0 | 4.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.