Wordfence 2FA Accepts Any Code — Critical Security Issue

Hi there,

We’re experiencing a critical security issue with Wordfence Login Security on one of our WooCommerce sites. Two-factor authentication has always worked correctly, but since today we discovered that users can log in by entering any 2FA code — even completely random numbers.

This obviously should not be possible, and it indicates that the 2FA validation is being skipped or bypassed somehow.

Here’s what we’ve checked so far:

The site is running the latest version of Wordfence and Wordfence Login Security
No errors or warnings are shown in Wordfence logs
2FA is enabled and required for the affected user roles
The issue happens both on the WooCommerce “My Account” login page and the wp-login.php page
The issue started suddenly without known configuration changes
Has anyone experienced this before or is there a known vulnerability or bug related to 2FA validation being bypassed?

Any guidance or suggestions on where to look next would be greatly appreciated — this is quite urgent due to the security impact.

Thanks in advance!