CVE-2025-13587

The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. This is because the SS88_2FAVE::wp_login() method only enforces the 2FA requirement if the 'token' HTTP GET parameter is undefined, which makes it possible to bypass two-factor authentication by supplying any value in the 'token' parameter during login, including an empty one.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/two-factor-2fa-via-email/trunk/ss88-two-factor-via-email.php#L218
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3408531%40two-factor-2fa-via-email&new=3408531%40two-factor-2fa-via-email&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/11fbe76c-dc5c-413c-b6a8-d0f4aa56935d?source=cve

Configurations

No configuration.

History

No history.

Information

Published : 2026-02-19 07:17

Updated : 2026-06-17 08:34

NVD link : CVE-2025-13587

Mitre link : CVE-2025-13587

CVE.ORG link : CVE-2025-13587

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-13587", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13587", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:04:07.323978Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "ss88_uk", "product": "Two Factor (2FA) Authentication via Email", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.9.8"}], "defaultStatus": "unaffected"}]}], "published": "2026-02-19T07:17:31.087", "references": [{"url": "https://plugins.trac.wordpress.org/browser/two-factor-2fa-via-email/trunk/ss88-two-factor-via-email.php#L218", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3408531%40two-factor-2fa-via-email&new=3408531%40two-factor-2fa-via-email&sfp_email=&sfph_mail=", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/11fbe76c-dc5c-413c-b6a8-d0f4aa56935d?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. This is because the SS88_2FAVE::wp_login() method only enforces the 2FA requirement if the 'token' HTTP GET parameter is undefined, which makes it possible to bypass two-factor authentication by supplying any value in the 'token' parameter during login, including an empty one."}, {"lang": "es", "value": "El plugin de Autenticaci\u00f3n de Dos Factores (2FA) v\u00eda Correo Electr\u00f3nico para WordPress es vulnerable a la omisi\u00f3n de autenticaci\u00f3n de dos factores en versiones hasta la 1.9.8, inclusive. Esto se debe a que el m\u00e9todo SS88_2FAVE::wp_login() solo aplica el requisito de 2FA si el par\u00e1metro GET HTTP 'token' no est\u00e1 definido, lo que hace posible omitir la autenticaci\u00f3n de dos factores al proporcionar cualquier valor en el par\u00e1metro 'token' durante el inicio de sesi\u00f3n, incluyendo uno vac\u00edo."}], "lastModified": "2026-06-17T08:34:24.443", "sourceIdentifier": "security@wordfence.com"}