WP 2FA – Two-factor authentication for WordPress

Endringslogg

4.2.0 (2026-10-05)

• New features & functionality

  • Added automatic migration of authenticator app (TOTP) configurations from Wordfence Login Security. Users migrate when they log in, and administrators can track progress and see when migration is complete.
  • Added smart tag controls to the email and SMS template editors under White labeling.
  • Added an optional setup wizard step to install Melapress Login Security in the background. Installation is disabled by default and requires administrator approval.
  • Added WordPress.org Live Preview support for the free edition through WordPress Playground.

• Security fixes

  • Fixed a CSRF vulnerability affecting REST request handling in WP 2FA 4.1.0 that could allow unauthorized actions through a logged-in administrator. Thanks to Filip Kowalski for responsibly reporting this issue through Patchstack.
  • Fixed a customer-reported multisite issue where an unresolved user role could remove the user’s configured 2FA method across the network and stop 2FA prompts.

• Functionality & plugin improvements

  • Raised the minimum required WordPress version from 5.5 to 5.7 to match the functions used by the plugin.
  • Improved settings import validation to reject invalid 2FA configuration data.
  • Settings imports now keep the “Limit access to the plugin settings” restriction in effect.
  • Aligned multisite settings export permissions with import permissions, requiring network administrator access.
  • Aligned permissions for removing 2FA and unlocking users on multisite with WordPress user-editing permissions.
  • Improved the “Limit access to the plugin settings” option so it consistently restricts other administrators in both interfaces.
  • Improved validation and CSS output handling for custom login page colors and logo URLs.
  • Passkey sign-in REST routes now register their declared arguments correctly, allowing WordPress to apply the intended validation.
  • Authy OneTouch logins now respect the wp_2fa_rememberme filter, matching the standard login flow.
  • Default email templates now use {wp_admin_email} for the administrator contact address instead of the plugin’s sender address, without replacing customized templates.
  • Authy settings are now hidden on installations where Authy has not already been configured.
  • Expanded white-label customization to cover the panel showing a user’s currently configured 2FA method on their profile.
  • Added information under White labeling about changing the 2FA login page URL with Melapress Login Security.
  • Updated setup wizard button sizes to make the Continue action more prominent.
  • Clarified the setup wizard text for grace periods, account blocking, and configuration reminders.
  • Updated the 2FA reconfiguration dialog to match the new interface.
  • Improved translation support by using complete sentences and proper plural forms.
  • Added Dutch translation files.
  • Added support for the Easy Digital Downloads (EDD) licensing module.
  • Admin notices from other Melapress plugins can now appear on WP 2FA pages.

• Bug fixes

  • Fixed settings imports leaving settings created after an export unchanged instead of restoring the exported configuration.
  • Corrected the status labels shown for created, updated, and unchanged settings after an import.
  • Corrected integer and boolean validation, including handling of valid 0 and false values, and addressed PHP 7.4 compatibility in the validator.
  • Fixed test emails leaving supported subject tags and the {backup_codes} placeholder unreplaced. Backup-code previews use sample codes rather than real recovery codes.
  • Fixed a PHP undefined-variable warning when an invalid Yubico token causes a parsing error.
  • Fixed white-label placeholder replacement altering custom CSS rules and generating Array to string conversion warnings.
  • Fixed the default “User account unlocked” email missing the site name and closing text, and corrected its HTML formatting.
  • Fixed failed email and SMS sends being recorded as successful, which could prevent users from retrying.
  • Fixed Twilio connection errors, server errors, and invalid responses being treated as successful SMS sends.
  • Fixed repeated loading of the email 2FA screen sending excessive code emails and repeatedly invalidating earlier codes.
  • Fixed plugin deletion failing or remaining stuck when DISABLE_2FA_LOGIN is enabled.
  • Removed redundant Go back and Continue buttons from the method selection screen after upgrading existing installations.
  • Fixed the report generation progress screen showing an incorrect total user count.
  • Fixed reports classifying users as “Configured (but not required)” when 2FA is required for all users and the excluded-users list is empty.
  • Fixed PHP warnings from openssl_decrypt() when malformed codes reach the out-of-band login handler.
  • Fixed missing grace period information in login notices for users signing in with passkeys.
  • Fixed REST-based 2FA logins ignoring the WordPress “Remember Me” selection.
  • Fixed the malformed URL for the passkey profile script that caused a 404 error on the WooCommerce My Account 2FA page.
  • Fixed interrupted user policy updates being marked as complete, preventing later attempts to refresh the user’s policy state.
  • Restored one-time code tag replacement in email subject lines.
  • Fixed zero-setup email 2FA being assigned to and required for users whose roles are excluded from 2FA.
  • Fixed passkey configuration buttons not following the setting that enables or disables WP 2FA styling.
  • Stopped loading passkey assets on the WooCommerce My Account 2FA page when passkeys are disabled by the applicable policy.
  • Fixed fatal errors during QR code generation when the PHP iconv extension is unavailable.
  • Fixed missing PHP xmlwriter support causing fatal errors on the Profile and Edit User pages.

Refer to the complete plugin changelog for more detailed information about what was new, improved and fixed in previous version updates of WP 2FA.