https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T12:54:29.981445+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-12988 CVE-2026-12988 — WP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Binding 2026-10-12T12:54:29.995516+00:00

Affected: Unknown WP 2FA

The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.