{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13587", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-23T14:04:31.558Z", "datePublished": "2026-02-19T04:36:05.735Z", "dateUpdated": "2026-04-08T16:36:20.584Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:20.584Z"}, "affected": [{"vendor": "ss88_uk", "product": "Two Factor (2FA) Authentication via Email", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.9.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. This is because the SS88_2FAVE::wp_login() method only enforces the 2FA requirement if the 'token' HTTP GET parameter is undefined, which makes it possible to bypass two-factor authentication by supplying any value in the 'token' parameter during login, including an empty one."}], "title": "Two Factor (2FA) Authentication via Email <= 1.9.8 - Two-Factor Authentication Bypass via token", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/11fbe76c-dc5c-413c-b6a8-d0f4aa56935d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/two-factor-2fa-via-email/trunk/ss88-two-factor-via-email.php#L218"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3408531%40two-factor-2fa-via-email&new=3408531%40two-factor-2fa-via-email&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-20 Improper Input Validation", "cweId": "CWE-20", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ulyses Saicha"}], "timeline": [{"time": "2026-02-18T15:31:37.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:04:07.323978Z", "id": "CVE-2025-13587", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:39:55.138Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13587", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:04:07.323978Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:04:08.899Z"}}], "cna": {"title": "Two Factor (2FA) Authentication via Email <= 1.9.8 - Two-Factor Authentication Bypass via token", "credits": [{"lang": "en", "type": "finder", "value": "Ulyses Saicha"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}}], "affected": [{"vendor": "ss88_uk", "product": "Two Factor (2FA) Authentication via Email", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.9.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T15:31:37.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/11fbe76c-dc5c-413c-b6a8-d0f4aa56935d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/two-factor-2fa-via-email/trunk/ss88-two-factor-via-email.php#L218"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3408531%40two-factor-2fa-via-email&new=3408531%40two-factor-2fa-via-email&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. This is because the SS88_2FAVE::wp_login() method only enforces the 2FA requirement if the 'token' HTTP GET parameter is undefined, which makes it possible to bypass two-factor authentication by supplying any value in the 'token' parameter during login, including an empty one."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-19T04:36:05.735Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13587", "state": "PUBLISHED", "dateUpdated": "2026-02-19T17:39:55.138Z", "dateReserved": "2025-11-23T14:04:31.558Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:05.735Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Two Factor (2FA) Authentication via Email plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 1.9.8. This is because the SS88_2FAVE::wp_login() method only enforces the 2FA requirement if the 'token' HTTP GET parameter is undefined, which makes it possible to bypass two-factor authentication by supplying any value in the 'token' parameter during login, including an empty one."}, {"lang": "es", "value": "El plugin de Autenticaci\u00f3n de Dos Factores (2FA) v\u00eda Correo Electr\u00f3nico para WordPress es vulnerable a la omisi\u00f3n de autenticaci\u00f3n de dos factores en versiones hasta la 1.9.8, inclusive. Esto se debe a que el m\u00e9todo SS88_2FAVE::wp_login() solo aplica el requisito de 2FA si el par\u00e1metro GET HTTP 'token' no est\u00e1 definido, lo que hace posible omitir la autenticaci\u00f3n de dos factores al proporcionar cualquier valor en el par\u00e1metro 'token' durante el inicio de sesi\u00f3n, incluyendo uno vac\u00edo."}], "id": "CVE-2025-13587", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-02-19T07:17:31.087", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/two-factor-2fa-via-email/trunk/ss88-two-factor-via-email.php#L218"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3408531%40two-factor-2fa-via-email&new=3408531%40two-factor-2fa-via-email&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/11fbe76c-dc5c-413c-b6a8-d0f4aa56935d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.9.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Two Factor (2FA) Authentication via Email", "source": "cna", "vendor": "ss88_uk"}, "product": "two_factor_(2fa)_authentication_via_email", "vendor": "ss88_uk"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-22T19:55:17.389197+00:00", "value": {"mitigation_remediation": ["Update the Two Factor (2FA) Authentication via Email plugin to a version newer than 1.9.8 that removes the token\u2011bypass logic.", "Reconfigure or patch the plugin to reject any \u2018token\u2019 value that is not a valid, cryptographically signed token before allowing authentication to proceed.", "Verify that the site\u2019s login flow requires a second factor after successful credential validation, and monitor logs for unexpected \u2018token\u2019 parameters in login attempts."], "summary": {"action": "Immediate Patch", "impact": "Two-factor authentication bypass"}, "threat_synthesis": {"affected_systems": "Users of the Two Factor (2FA) Authentication via Email WordPress plugin from ss88_uk, versions 1.9.8 and earlier, are affected. No other vendors or products are listed.", "description_and_impact": "The WordPress Two Factor (2FA) Authentication via Email plugin fails to enforce the second factor when the HTTP GET parameter \u2018token\u2019 is present, even if it is empty. This flaw, based on improper input validation (CWE\u201120), enables an attacker to log in without completing the two\u2011factor step. A successful bypass undermines account security and grants an attacker unauthorized access to any account credentials that reach the login endpoint.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1\u202f% suggests a low likelihood of widespread exploitation at present, and the vulnerability is not yet listed in CISA\u2019s KEV catalog. Exploitation requires an attacker to supply a \u2018token\u2019 value during login, which most current login implementations do not reject. If the vulnerable plugin is enabled, credential holders can be compromised with this simple parameter manipulation."}}}}, "created": "2026-02-19T10:07:25.048420+00:00", "updated": "2026-04-22T20:00:08.846147+00:00", "vendors": ["ss88_uk", "ss88_uk$PRODUCT$two_factor_(2fa)_authentication_via_email", "wordpress", "wordpress$PRODUCT$wordpress"]}