All issues

Search results

Backup codes download file identifies the site by full URL rather than name or host

Status: Open.

#957 In WordPress/two-factor;

· dknauss opened on Aug 10, 2026

generate_codes() with 'method' => 'append' stores an empty code when the user has none

Status: Open.

#956 In WordPress/two-factor;

· dknauss opened on Aug 10, 2026

Privacy: register a personal data exporter and eraser

Status: Open.

#954 In WordPress/two-factor;

· dknauss opened on Aug 9, 2026

Enrolling a second factor destroys the user's other sessions and sends no notification

Status: Open.

#953 In WordPress/two-factor;

· dknauss opened on Aug 9, 2026

Conflict between Two Factor (v0.16.0) and Login with Google plugin

Status: Open.

#951 In WordPress/two-factor;

· masteradhoc opened on Aug 5, 2026

Password managers can capture the TOTP setup QR and lock users out of login

Emailed Codes

TOTPTime-based One-time PasswordsTime-based One-time Passwords

Status: Open.

#945 In WordPress/two-factor;

· dknauss opened on Jul 25, 2026

Normalize malformed primary-provider meta before array-key access

Status: Open.

#944 In WordPress/two-factor;

· chubes4 opened on Jul 23, 2026

Keep authentication fail-closed when provider filters change between lookups

Status: Open.

#943 In WordPress/two-factor;

· chubes4 opened on Jul 23, 2026

Normalize malformed enabled-provider user meta before array operations

Status: Open.

#941 In WordPress/two-factor;

· chubes4 opened on Jul 23, 2026

Recovery-code REST route accepts nonexistent users

Status: Open.

#937 In WordPress/two-factor;

· chubes4 opened on Jul 23, 2026

Reject oversized TOTP confirmation codes before validation

Status: Open.

#936 In WordPress/two-factor;

· chubes4 opened on Jul 22, 2026

Expose provider management and server-owned TOTP enrollment over REST

Status: Open.

#934 In WordPress/two-factor;

· chubes4 opened on Jul 22, 2026