WebAuthn Two-Factor Authentication Bypass in WordPress Plugin

CVE-2026-11883 represents a critical authentication weakness in the WebAuthn Provider for Two Factor WordPress plugin versions before 2.5.6. The vulnerability allows attackers who have obtained a user's password to completely bypass the second-factor authentication mechanism by crafting a malformed WebAuthn response. This is particularly dangerous because it undermines the entire purpose of two-factor authentication—even if users follow security best practices by using strong passwords, attackers can still gain unauthorized access by exploiting improper validation logic. WordPress sites using this plugin are at immediate risk, especially those protecting sensitive content or managing multiple user accounts with administrative privileges.

While this CVE currently has no mapped MITRE ATT&CK techniques or CWE classification, Casky's threat detection capabilities would identify the attack patterns associated with this vulnerability through behavioral analysis of authentication requests. Practitioners using Casky would observe suspicious patterns consistent with credential access attempts (ATT&CK T1110 - Brute Force or T1621 - Multi-Factor Authentication Interception), specifically malformed requests that attempt to manipulate WebAuthn challenge-response validation. Extended reasoning analysis would flag inconsistencies in authentication response structures, failed validation logic exploitation, and account access immediately following failed second-factor attempts. Security teams should immediately audit authentication logs for malformed WebAuthn requests and patch affected installations to version 2.5.6 or later to restore proper response validation.