CVE-2026-108066: CWE-639 Authorization Bypass Through User-Controlled Key in WP 2FA

The WP 2FA plugin versions prior to 4.2.0 do not perform object-level capability checks when removing a user's two-factor authentication configuration. This flaw allows a WordPress Multisite site administrator to remove 2FA settings for users belonging to other sites within the multisite network, including those accounts they are not authorized to manage. The vulnerability is specific to multisite setups; single-site administrators already have full user management capabilities, so the issue does not extend trust boundaries in that context.

On WordPress Multisite installations using WP 2FA versions before 4.2.0, site administrators can bypass authorization controls to remove two-factor authentication configurations of users outside their own site. This could weaken the security posture of those users by disabling their 2FA protections without their consent. The impact is limited to multisite environments and does not affect single-site WordPress installations in the same manner.

Upgrade WP 2FA to version 4.2.0 or later, where this authorization bypass vulnerability has been addressed. No other mitigation steps are indicated. Patch status is not explicitly confirmed in the provided data, but the version 4.2.0 is implied as the fixed version. Verify with the vendor advisory for the official fix.