TI-2022-02681 Aliases CVE-2022-2891 GHSA-354f-972f-vpc2

WP 2FA < 2.3.0 - Time-Based Side-Channel Attack

LOW 28CWE-203Published 2022-10-10 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-203.

Summary

The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.

Why it matters now

EPSS 0.00969 62nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed WP 2FA (Unknown): 2.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	WP 2FA	before 2.3.0	2.3.0	Patch available	CNA

WP 2FA VendorUnknown Affected before 2.3.0 Fixed in 2.3.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wpwhitesecurity:wp_2fa::::::wordpress::*	before 2.3.0	Vulnerable	wpwhitesecurity

cpe:2.3:a:wpwhitesecurity:wp_2fa:*:*:*:*:*:wordpress:*:* Versions before 2.3.0 Vulnerable ·wpwhitesecurity

Remediation

Fix · CNA WP 2FA (Unknown) Fixed in 2.3.0

Timeline

2026-10-02 Threatist record created from CVE-2022-2891
2026-10-03 Alias added: GHSA-354f-972f-vpc2

References

Exploit 1

https://wpscan.com/vulnerability/301b3dce-2584-46ec-92ed-1c0626522120

TI-2022-01400 WP 2FA < 2.2.1 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
TI-2023-05963 WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences