← back to popular plugins
wordfence / plugin · wp-2fa
WP 2FA – Two-factor authentication for WordPress
wp-2fa
total installs
100,000
total vulns
1
critical
0
high
0
medium
1
low
0
latest vuln
—
patched
1
unpatched
0
avg time to patch
—
vulnerabilities
(1)
WP 2FA – Two-factor authentication for WordPress <= 2.9.3 - 2-Factor Authentication Bypass
medium
✓ patched
cve id
CVE-2025-12628 ↗
cvss score
5.3
cwe
CWE-693: Protection Mechanism Failure
published
Nov 3, 2025
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to 2FA bypass in all versions up to, and including, 2.9.3. This makes it possible for unauthenticated attackers to bypass 2FA protection. Please note Wordfence does not consider this a security vulnerability and previously rejected assigning a CVE ID to this issue. This is being included for informational purposes.