CVE-2024-9820: wp 2fa with (CVSS 6.5)

Description

The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication.

Is your site exposed to CVE-2024-9820?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness Type (CWE)

CWE-784 CWE-784

CWE-565 CWE-565

Affected Products

Vendor	Product	Versions
dueclic	wp_2fa_with_telegram	< 3.1

References

Other References

https://plugins.trac.wordpress.org/browser/two-factor-login-telegram/tags/3.0/includes/class-wp-factor-telegram-plugin.php#L228 https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd73030-7185-4302-b3fd-29cbbe716e3e?source=cve

Frequently Asked Questions

What is CVE-2024-9820? +

The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2024-9820? +

CVE-2024-9820 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-9820? +

CVE-2024-9820 affects products from dueclic, specifically: wp_2fa_with_telegram. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-9820? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-60134 8.8

Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.

CVE-2026-45055 8.1

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the Host request …

CVE-2024-9687 8.8

The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. …

CVE-2024-9820