CVE-2026-100508

Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.

Published Sep 30, 2026
CVSS 5.3 medium
0.3% chance of exploitation in the next 30 days (EPSS)

Affected software

WordPress.org Two Factor

CVE-2026-100508 at the National Vulnerability Database