{"id":"CVE-2025-12628","aliases":["EUVD-2025-198648","GHSA-92fr-wf6q-p5h2"],"status":"published","title":"WP 2FA \u003c 3.0.0 - Second Factor Bypass","description":"The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0022,"percentile":0.12647,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2025-11-24T12:58:37Z","modified":"2026-10-08T10:10:00Z","products":[{"vendor":"unknown","product":"wp 2fa"}],"references":[{"url":"https://wpscan.com/vulnerability/5e2d033c-dde6-4774-8588-cbe268c0d797/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12628"},{"url":"https://wpscan.com/vulnerability/5e2d033c-dde6-4774-8588-cbe268c0d797"},{"url":"https://github.com/advisories/GHSA-92fr-wf6q-p5h2"}],"sources":{"cve":[{"id":"CVE-2025-12628","title":"WP 2FA \u003c 3.0.0 - Second Factor Bypass","description":"The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them","status":"published","published":"2025-11-24T12:58:37.015Z","modified":"2025-11-24T15:09:10.78Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:32:42.078906Z"}],"euvd":[{"id":"EUVD-2025-198648","description":"The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them","status":"published","published":"2025-11-24T12:58:37Z","modified":"2025-11-24T15:09:10Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:13.187271Z"}],"ghsa":[{"id":"GHSA-92fr-wf6q-p5h2","title":"The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow...","description":"The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them","status":"published","published":"2025-11-24T15:30:28Z","modified":"2025-11-24T18:32:15Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:04:55.899096Z"}],"nvd":[{"id":"CVE-2025-12628","description":"The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them","status":"published","published":"2025-11-24T13:16:01.223Z","modified":"2026-10-08T10:10:00.227Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:11:46.009629Z"}]}}