CVE-2026-103514 describes an improper authentication vulnerability (CWE-287) in the WP 2FA WordPress plugin prior to version 4.1.0. The vulnerability arises because the plugin does not invalidate a time-based one-time passcode once it has been used. Consequently, an attacker with knowledge of an account's password and access to a valid TOTP within its time window can replay the code to bypass two-factor authentication protections, potentially gaining unauthorized access to accounts including those with administrative privileges.

An attacker who has obtained both the account password and a valid time-based one-time passcode within its validity window can bypass the two-factor authentication mechanism. This compromises the security of accounts protected by WP 2FA, including administrator accounts, potentially allowing unauthorized access and control over the WordPress site.

Upgrade the WP 2FA plugin to version 4.1.0 or later, where this vulnerability has been addressed. No other mitigation guidance is provided. Patch status is not explicitly stated but the presence of a fixed version (4.1.0) implies an official fix is available.