CVE-2026-15372 is an improper authentication vulnerability (CWE-287) in the WP 2FA WordPress plugin prior to version 4.1.0. The vulnerability arises because the plugin fails to validate the second factor of authentication when one of its supported 2FA methods is selected at login. An attacker with knowledge of a valid user's password can exploit this flaw to bypass the two-factor authentication mechanism entirely, thereby gaining full access to the user's account, including accounts with administrative rights. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

An attacker who knows a valid user's password can bypass the two-factor authentication protection in the affected WP 2FA plugin versions. This leads to unauthorized full access to the user's account, including administrator accounts, potentially compromising the entire WordPress site. The confidentiality of the site and its data is at high risk, while integrity and availability impacts are not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the WP 2FA plugin or enforcing alternative two-factor authentication solutions to protect accounts. Monitoring for suspicious login activity is advisable. Avoid relying solely on the affected plugin's 2FA mechanisms for critical accounts.