CVE-2025-12628
CVE-2025-12628
Medium · published November 24, 2025
What it is
The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass the second factor by brute forcing them
The record
Technical detail
- CVSS v3.1
- 6.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00205 · 10.0th percentile
- Published
- 2025-11-24T18:16Z
References (1)
EPSS history
Timeline