A critical authentication bypass vulnerability in the WP 2FA WordPress plugin allows attackers to circumvent security measures and gain full account access, requiring an immediate update to version 4.1.0.

The plugin fails to validate the second authentication factor during the login process (CWE-287). This allows an attacker who has already obtained a user's password to bypass the 2FA requirement and gain full unauthorized access to the account, including administrative accounts.

With a CVSS score of 7.5, this vulnerability presents a significant risk to account security. By bypassing secondary authentication, attackers can effectively negate the protection provided by MFA, leading to unauthorized access to sensitive administrative functions and organizational data.

Immediate Action: Update the WP 2FA plugin to version 4.1.0 or later to restore proper authentication validation.

Proactive Monitoring: Audit user login activity for successful authentications that occurred without an associated 2FA validation event.

Compensating Controls: If immediate patching is not feasible, consider temporarily disabling the plugin or enforcing alternative authentication controls at the web server or identity provider level.

Public Exploit Available: No (no confirmed public exploit available).

Given that this vulnerability renders the two-factor authentication mechanism ineffective, it poses a severe threat to all protected accounts. Security teams must prioritize updating to version 4.1.0 to ensure that multi-factor authentication remains a functional barrier against unauthorized access.