Description
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Unknown WP 2FA
Default version status: unaffected
0 to < 4.2.0affected