The WP 2FA with Telegram plugin for WordPress (AuthPress by dueclic) suffers from a security flaw where the two-factor authentication code is stored insecurely in a cookie. Because the cookie lacks validation and integrity checks, an attacker with access to the cookie can bypass the two-factor authentication process. This vulnerability is tracked as CVE-2024-9820 and has a CVSS 3.1 base score of 6.5 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official fix has been published by the vendor, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows an attacker to bypass two-factor authentication by manipulating or reusing the two-factor code stored in a cookie. This compromises the integrity of the authentication process, potentially enabling unauthorized access to user accounts protected by the vulnerable plugin. There is no direct confidentiality or availability impact reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable plugin or two-factor authentication feature relying on it to prevent bypass. Monitoring vendor channels for updates is recommended. No vendor advisory or patch links are currently provided.