CVE-2025-13587

{"id": "CVE-2025-13587", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2026-02-19T07:17:31.087", "references": [{"url": "https://plugins.trac.wordpress.org/browser/two-factor-2fa-via-email/trunk/ss88-two-factor-via-email.php#L218", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3408531%40two-factor-2fa-via-email&new=3408531%40two-factor-2fa-via-email&sfp_email=&sfph_mail=", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/11fbe76c-dc5c-413c-b6a8-d0f4aa56935d?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. This is because the SS88_2FAVE::wp_login() method only enforces the 2FA requirement if the 'token' HTTP GET parameter is undefined, which makes it possible to bypass two-factor authentication by supplying any value in the 'token' parameter during login, including an empty one."}, {"lang": "es", "value": "El plugin de Autenticaci\u00f3n de Dos Factores (2FA) v\u00eda Correo Electr\u00f3nico para WordPress es vulnerable a la omisi\u00f3n de autenticaci\u00f3n de dos factores en versiones hasta la 1.9.8, inclusive. Esto se debe a que el m\u00e9todo SS88_2FAVE::wp_login() solo aplica el requisito de 2FA si el par\u00e1metro GET HTTP 'token' no est\u00e1 definido, lo que hace posible omitir la autenticaci\u00f3n de dos factores al proporcionar cualquier valor en el par\u00e1metro 'token' durante el inicio de sesi\u00f3n, incluyendo uno vac\u00edo."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "security@wordfence.com"}