New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

2FA not Enforced if a User has an Additional Capability and wpga_active not Set #43

Open

asif-anwar opened this issue Sep 30, 2021 · 0 comments

asif-anwar commented Sep 30, 2021

Hey,

I want to report a corner case. We have enforced 2FA for a select list of roles. But the user is able to log in without 2FA if,

The user has a capability directly assign to him in addition to a normal role like this a:2:{s:14:"capability_new";b:1;s:10:"subscriber";b:1;},
And wpga_active meta key is not set. We have a lot of cases where the 2FA is active but wpga_active is not set
And the capability comes before the role.

Thanks
Asif

The text was updated successfully, but these errors were encountered:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment