CVE-2023-6272
Theme My Login 2FA < 1.2 - Lack of Rate Limiting
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
18 Dec 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn't be too long, as the 2FA codes are 6 digits.
Affected products
Unknown · tml-2faWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →