Keyy Two Factor Authentication Privilege Escalation Vulnerability in WordPress

A privilege escalation vulnerability allowing account takeover has been identified in the Keyy Two Factor Authentication (like Clef) plugin for WordPress, affecting all versions through 1.2.3. The vulnerability arises because the plugin fails to properly validate a user's identity linked to a generated token. This flaw enables authenticated attackers with subscriber-level access or higher to create valid authentication tokens and use them to automatically log in as other users, including administrators, provided the administrator has two-factor authentication enabled.

Impact

Exploitation of this vulnerability allows authenticated users with subscriber-level access and above to take over other accounts, including those of administrators, by exploiting the two-factor authentication mechanism.