CVE-2022-0993

The SiteGround Security plugin for WordPress before version 1.2.6 contains an authentication bypass vulnerability in its two-factor authentication backup code feature. An unauthenticated attacker can exploit inadequate verification mechanisms in the 2FA backup code process to successfully authenticate as an administrator. The flaw stems from the backup code implementation failing to properly validate user identity before granting login access. Versions 1.2.5 and earlier are affected by this security weakness.

Based on public CVE data (MITRE/NVD).