Skip to content
PluginCanary

WP 2FA - Two-factor authentication for WordPress

by Melapress · 100,000+ active installs · Checked 3 Nov 2026
Watch4 Warnings

Watch: new committer lucianwpwhite made a first commit on 4 Nov 2026.

79/ 100 Canary Score
Sub-scores for WP 2FA - Two-factor authentication for WordPress
Ownership80
Maintenance100
Security70
Support69
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningOWN-1New committer lucianwpwhite made a first commit on 4 Nov 2026. Review the latest release before updating, and consider disabling auto-updates for this plugin.4 Nov 2026Evidence
  • WarningSEC-1Vulnerability published 14 Oct 2026, fixed in 4.2.0. Update to version 4.2.0 or later.14 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 8 Oct 2026, fixed in 4.2.0. Update to version 4.2.0 or later.8 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 1 Oct 2026, fixed in 4.1.0. Update to version 4.1.0 or later.1 Oct 2026Evidence
  • InfoSEC-36 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master18 Mar 2020 to 18 Mar 2020, 1 commits
WPWhiteSecurity20 Mar 2020 to 19 Dec 2023, 95 commits
melapress16 Jan 2024 to 14 Oct 2026, 55 commits
lucianwpwhite4 Nov 2026 to 4 Nov 2026, 2 commits

New committer lucianwpwhite made a first commit on 4 Nov 2026.

Maintenance

Last release
21 days ago
Releases, 24 months
13
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for WP 2FA - Two-factor authentication for WordPress
Q1 20243
Q2 20241
Q3 20241
Q4 20240
Q1 20250
Q2 20250
Q3 20255
Q4 20252
Q1 20262
Q2 20260
Q3 20262
Q4 20262

Last release 14 Oct 2026. Tested with WordPress 7.1 (current).

Support

69% of 16 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
14 Oct 2026WP 2FA – Two-factor authentication for WordPress < 4.2.0 - Authenticated (Administrator+) Insecure Direct Object Reference2.7< 4.2.04.2.00
8 Oct 2026WP 2FA – Two-factor authentication for WordPress <= 4.1.0 - Cross-Site Request Forgery4.3<= 4.1.04.2.00
1 Oct 20262FA <= 4.0.0 - Unauthenticated Two-Factor Authentication Bypass4.3<= 4.0.04.1.00
29 Jul 20262FA <= 4.0.0 - Two-Factor Authentication Bypass4.3<= 4.0.04.1.00
23 Jun 2026WP 2FA <= 3.1.1.1 - Authenticated (Subscriber+) Account Takeover4.3<= 3.1.1.13.1.1.20
3 Nov 2025WP 2FA – Two-factor authentication for WordPress <= 2.9.3 - 2-Factor Authentication Bypass5.3<= 2.9.33.0.00
20 Jun 2024WP 2FA <= 2.6.3 - Unauthenticated Information Exposure via Log File5.3<= 2.6.32.6.40
16 Apr 2024WP 2FA – Two-factor authentication for WordPress <= 2.6.2 - Reflected Cross-Site Scripting6.1<= 2.6.22.6.30
2 Jan 2024WP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgery4.3<= 2.5.02.6.00
2 Jan 2024WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending4.3<= 2.5.02.6.00
7 Dec 2022WP 2FA – Two-factor authentication for WordPress <= 2.2.0 - Missing Authorization4.3<= 2.2.02.2.10
14 Sep 2022WP 2FA <= 2.2.1 - Time-Based TOTP attack to Sensitive Information Exposure5.3<= 2.2.12.3.00
6 May 2022WP 2FA – Two-factor authentication for WordPress <= 2.2.0 - Reflected Cross-Site Scripting6.1<= 2.2.02.2.10
13 Apr 2022WP 2FA – Two-factor authentication for WordPress <= 2.1.0 - Insecure Direct Object Reference5.4<= 2.1.02.2.00

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for WP 2FA - Two-factor authentication for WordPress
Q4 20255.0
Q1 20265.0
Q2 20264.8
Q3 20264.8
Q4 20264.2

Average rating fell from 5.0 to 4.2 between Q4 2025 and Q4 2026.

Rating distribution
5 star165
4 star3
3 star1
2 star2
1 star13
Latest low reviews

Momentum

100,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP 2FA - Two-factor authentication for WordPress
4 May 20262,400
11 May 20265,074
18 May 20265,189
25 May 20264,674
1 Jun 20264,656
8 Jun 20264,585
15 Jun 20264,441
22 Jun 20264,469
29 Jun 20264,301
6 Jul 202654,014
13 Jul 202616,239
20 Jul 202658,159
27 Jul 202617,446
3 Aug 202616,178
10 Aug 202610,429
17 Aug 20269,476
24 Aug 20269,924
31 Aug 20269,402
7 Sep 20267,493
14 Sep 20267,654
21 Sep 20267,967
28 Sep 20268,121
5 Oct 202669,205
12 Oct 202666,297
19 Oct 202631,423
26 Oct 202621,832
2 Nov 20263,028

Weekly downloads over the last 4 weeks are 78% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

LoginizerScore 93 · 1,000,000+FluentAuth - Login Security, Two-Factor Authentication, Passkeys & Social LoginScore 93 · 10,000+All In One LoginScore 92 · 60,000+WPS Hide LoginScore 91 · 2,000,000+Temporary Login Without PasswordScore 91 · 90,000+

Facts

Version4.2.1
AuthorMelapress
Added20 Mar 2020
Last updated14 Oct 2026
Active installs100,000+
Requires WordPress5.7
Tested up to7.1.4
Requires PHP7.4
CategorySecurity & Privacy > Security Scanning & Malware Protection
Tags2FA, google authenticator, 2-factor authentication, WordPress authentication, two factor authentication

Other plugins by this author: WP Activity Log, Admin Notices Manager, Melapress File Monitor, Melapress Login Security, Melapress Role Editor

Questions

Is WP 2FA - Two-factor authentication for WordPress still maintained?

WP 2FA - Two-factor authentication for WordPress was last updated on 14 Oct 2026. Its Canary status is Watch.

Is WP 2FA - Two-factor authentication for WordPress safe?

WP 2FA - Two-factor authentication for WordPress has no open unpatched vulnerabilities on record. 6 vulnerabilities were published in the last 24 months. Its Canary status is Watch.

Who owns WP 2FA - Two-factor authentication for WordPress?

The wordpress.org author is Melapress. Recent committers: lucianwpwhite, melapress, WPWhiteSecurity, plugin-master. New committer lucianwpwhite made a first commit on 4 Nov 2026.

What can I use instead of WP 2FA - Two-factor authentication for WordPress?

Plugins in the same category with a higher Canary Score: Loginizer, FluentAuth - Login Security, Two-Factor Authentication, Passkeys & Social Login, All In One Login, WPS Hide Login, Temporary Login Without Password.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue