A critical authentication bypass vulnerability in the UsersWP plugin allows attackers to circumvent two-factor authentication, posing a significant risk of unauthorized account access.

This flaw exists within the plugin two-factor login handler, where a failure to properly validate the authentication provider allows an attacker who already possesses valid user credentials to bypass the secondary authentication step. This is categorized as an Improper Authentication issue (CWE-287).

The ability to bypass two-factor authentication significantly weakens the security posture of any WordPress site utilizing this plugin. Successful exploitation grants an attacker unauthorized access to user accounts, including administrative accounts if targeted, which could lead to data theft, unauthorized content modification, or full site compromise. While the CVSS score is 7.4, the potential for complete account takeover makes this a high-priority remediation item.

Immediate Action: Update the UsersWP plugin to version 1.2.67 or later immediately to incorporate the necessary authentication validation checks.

Proactive Monitoring: Review authentication and login logs for irregular patterns, such as multiple successful logins from disparate geographical locations or unusual login times for privileged accounts.

Compensating Controls: If an immediate update is not feasible, consider temporarily disabling the two-factor authentication feature or implementing strict IP-based access controls for the login interface via a Web Application Firewall (WAF).

Public Exploit Available: Unknown

Organizations utilizing the UsersWP plugin must treat this vulnerability with high urgency. Given that the fix is readily available in version 1.2.67, administrators should prioritize updating the plugin across all production instances to restore the integrity of the two-factor authentication process and prevent unauthorized account access.