rootpwn

critical · CVSS v3 9.8

CVE-2026-103514

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allow…

Description

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.

Scores

Severity
critical
CVSS v2
6.4
CVSS v3
9.8
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-104414

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.

View analysis

critical

CVE-2026-105080

ConvertX versions prior to 0.19.0 allow recipe files to be passed directly to Calibre's ebook-convert program, enabling execution of arbitrary code contained in .recipe or .downloaded_recipe files. This flaw can be exploited by attackers who supply malicious recipe files to a vulnerable ConvertX instance. The vulnerability is critical and can lead to full compromise of affected systems.

View analysis

critical

CVE-2026-79113

OpenAPV versions prior to 1.1.1.0 contain a heap-based buffer overflow in the read_bitstream function, allowing attackers to corrupt memory and potentially execute arbitrary code. This flaw can be exploited remotely by sending crafted data to vulnerable systems. The vulnerability is critical, with a CVSS v3 score of 9.8.

View analysis

critical

CVE-2026-92536

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the reg_nickname and reg_bio fields without a nonce requirement.

View analysis