Medium severity6.3NVD Advisory· Published Nov 24, 2025· Updated Apr 15, 2026
CVE-2025-12628
CVE-2025-12628
Description
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them
Affected products
1- Package: https://wordpress.org/plugins/wp-2fa
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.