Vulnerability · Published Dec 18, 2023 · Assigned by WPScan

CVE-2023-6272Theme My Login 2FA < 1.2 - Lack of Rate Limiting

Critical 9.8

In plain English

A critical-severity security flaw in tml-2fa from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)0.9%top 40.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits.

Affected products (as reported)

Vendor	Product	Versions
Unknown	tml-2fa	0 – before 1.2

References

https://wpscan.com/vulnerability/a03243ea-fee7-46e4-8037-a228afc5297a exploit, vdb-entry, technical-description