CVE-2025-13587 is an improper input validation vulnerability (CWE-20) in the ss88_uk Two Factor (2FA) Authentication via Email WordPress plugin. The vulnerability exists because the SS88_2FAVE::wp_login() method only enforces the 2FA requirement if the 'token' HTTP GET parameter is not present. By supplying any value, including an empty string, for the 'token' parameter during login, an attacker can bypass the two-factor authentication mechanism. This affects versions up to and including 1.9.8 of the plugin. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

Successful exploitation of this vulnerability allows an attacker with some level of privileges to bypass the two-factor authentication protection, potentially enabling unauthorized access to accounts protected by this plugin. The integrity of the affected system can be compromised, but confidentiality and availability are not impacted according to the CVSS vector. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users of the affected plugin versions should monitor the vendor's communications for updates. Until a fix is available, consider disabling the vulnerable plugin or implementing alternative two-factor authentication methods to mitigate risk.