Skip to content
PluginCanary

WebAuthn Provider for Two Factor

by Volodymyr Kolesnykov · 2,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 15 Oct 2026, 9 releases in 24 months, no unpatched vulnerabilities.

98/ 100 Canary Score
Sub-scores for WebAuthn Provider for Two Factor
Ownership100
Maintenance100
Security95
SupportNo data
ReputationNo data

How the score works

Quick answers

Is WebAuthn Provider for Two Factor still maintained?
Yes. Last release 15 Oct 2026, 9 releases in the last 24 months. 15 Oct 2026 · wordpress.org
Who owns WebAuthn Provider for Two Factor, and has it changed hands?
No change recorded. Main committer volodymyrkolesnykov since Jan 2022. 3 Nov 2026 · SVN log
Was WebAuthn Provider for Two Factor removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is WebAuthn Provider for Two Factor safe?
1 known vulnerability, fixed (latest in 2.5.6). Not on the exploited list. 10 Jun 2026 · Wordfence Intelligence
Is the latest WebAuthn Provider for Two Factor update safe to install?
No ownership change before 2.6.2. No one-star spike after it. 15 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master28 Jan 2022 to 28 Jan 2022, 1 commits
volodymyrkolesnykov28 Jan 2022 to 15 Oct 2026, 32 commits

2 committers recorded. No ownership change since 2022.

Maintenance

Last release
20 days ago
Releases, 24 months
9
Tested up to
7.1 current
Requires PHP
8.2 supported 8.2+
Releases per quarter
Releases per quarter for WebAuthn Provider for Two Factor
Q1 20240
Q2 20241
Q3 20244
Q4 20240
Q1 20253
Q2 20251
Q3 20250
Q4 20250
Q1 20264
Q2 20260
Q3 20260
Q4 20261

Last release 15 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.6.

Rating distribution
5 star9
4 star1
3 star0
2 star1
1 star0

Security record

1 vulnerability in 24 months, patched (latest fixed in 2.5.6).

Show 1 patched vulnerability
PublishedIssueCVSSAffectedFixed inDays to patch
10 Jun 2026WebAuthn Provider for Two Factor <= 2.5.5 - Two-Factor Authentication Bypass5.3<= 2.5.52.5.6Patched before disclosure

Changelog mentions of security fixes: 2.6.2 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

2,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WebAuthn Provider for Two Factor
4 May 202687
11 May 2026136
18 May 2026181
25 May 2026162
1 Jun 2026293
8 Jun 2026247
15 Jun 2026231
22 Jun 2026175
29 Jun 2026154
6 Jul 2026164
13 Jul 2026146
20 Jul 2026243
27 Jul 2026262
3 Aug 2026236
10 Aug 2026195
17 Aug 2026194
24 Aug 2026232
31 Aug 2026220
7 Sep 2026314
14 Sep 2026310
21 Sep 2026296
28 Sep 2026383
5 Oct 2026355
12 Oct 20261,598
19 Oct 20261,132
26 Oct 20261,004
2 Nov 2026122

Weekly downloads over the last 4 weeks are 187% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Two Factor AuthenticationScore 100 · 20,000+Login rebuilderScore 100 · 20,000+LWS Hide LoginScore 100 · 20,000+WP Limit Login AttemptsScore 100 · 10,000+Login Security CaptchaScore 100 · 10,000+

Facts

Version2.6.2
AuthorVolodymyr Kolesnykov
Added28 Jan 2022
Last updated15 Oct 2026
Active installs2,000+
Requires WordPress6.0
Tested up to7.1.4
Requires PHP8.2
CategoryUser Management & Authentication > Two-Factor Authentication (2FA)
Tags2FA, login, security, webauthn, two factor

Questions

Is WebAuthn Provider for Two Factor still maintained?

Yes. Last release 15 Oct 2026, 9 releases in the last 24 months.

Who owns WebAuthn Provider for Two Factor, and has it changed hands?

No change recorded. Main committer volodymyrkolesnykov since Jan 2022.

Was WebAuthn Provider for Two Factor removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is WebAuthn Provider for Two Factor safe?

1 known vulnerability, fixed (latest in 2.5.6). Not on the exploited list.

Is the latest WebAuthn Provider for Two Factor update safe to install?

No ownership change before 2.6.2. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue