CVE-2022-28601

6.5 mediumEPSS 1.8%

Medium (6.5) in lmsdoctor 2 factor authentication. EPSS 1.8% chance of exploitation in the next 30 days.

A Two-Factor Authentication (2FA) bypass vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor allows remote attackers to overwrite the phone number used for confirmation via the profile.php file. Therefore, allowing them to bypass the phone verification mechanism.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2022-05-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

lmsdoctor:2_factor_authentication

References

https://github.com/FlaviuPopescu/CVE-2022-28601
https://www.lmsdoctor.com/simple-2-factor-authentication-plugin-for-moodle
https://github.com/FlaviuPopescu/CVE-2022-28601
https://www.lmsdoctor.com/simple-2-factor-authentication-plugin-for-moodle

Check your stack JSON