Introduction
For a WordPress site owner, a basic subscriber account escalating to full administrator access is a worst-case scenario. The Keyy Two Factor Authentication plugin, once trusted for secure logins, now carries exactly that risk. A critical flaw lets authenticated users take over administrator accounts when 2FA is enabled. The plugin has been discontinued, so affected sites get no patch and no support.
Nexist, an Australian business consulting firm, developed Keyy Two Factor Authentication. The plugin was meant to make WordPress logins simpler and stronger by using RSA public-key cryptography and mobile-based 2FA. It was part of the WordPress ecosystem for several years, with both free and premium versions. As of October 2025, the vendor has left the plugin market, and users have to migrate to other solutions.
Technical Information
CVE-2025-10293 comes from improper validation of user identity in the authentication token workflow. Any user with subscriber-level access or higher can generate authentication tokens through the Keyy plugin, and the plugin does not make sure those tokens are strictly tied to the identity of the user who created them. An attacker can therefore create a token that the plugin accepts for another account, including an administrator account, as long as the target account has Keyy 2FA enabled.
The vulnerability is classified as CWE-287 (Improper Authentication). Exploitation requires two conditions:
- The attacker must have an authenticated account (subscriber or above) on the target WordPress site.
- The target administrator account must have Keyy 2FA enabled.
By abusing the token generation and validation logic, the attacker can log in automatically as the administrator and take full control of the site. No public code snippets or PoC details are available, but multiple security advisories confirm the flaw.
Affected Systems and Versions
- Product: Keyy Two Factor Authentication (like Clef) plugin for WordPress
- Affected Versions: All versions up to and including 1.2.3
- Vulnerable Configuration: Any WordPress site with Keyy 2FA enabled for administrator accounts
Vendor Security History
Nexist, which mainly operates as a business consulting firm, maintained Keyy. No earlier high-profile vulnerabilities have been reported for the plugin. Nexist announced the discontinuation at the same time as the vulnerability disclosure, and Keyy users have no patch and no ongoing support.
