https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 20:41:31 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-108066 <p>The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user&#39;s two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.</p> <p>The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user&#39;s two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.</p> https://db.gcve.eu/vuln/fkie_cve-2026-108066 https://db.gcve.eu/vuln/ghsa-pxwp-79fp-hgfv <p>The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user&#39;s two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.</p> <p>The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user&#39;s two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.</p> https://db.gcve.eu/vuln/ghsa-pxwp-79fp-hgfv