NVD security advisory
Security advisory for The Two Factor Authentication WordPress plugin
CVE-2026-111739
Full advisory details, affected packages, severity context, and original source.
Affected technology
The Two Factor Authentication WordPress pluginAffected product
Advisory overview
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.