{"metadata": {"vulnerability": "CVE-2026-108066", "count": 13, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-10-09T11:16:45.819Z", "date_only": false, "value": "2026-10-09T11:16:45.819Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-108066", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T06:00:12.277Z", "date_only": false, "value": "2026-10-14T06:00:12.277Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-108066", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T06:00:12.277Z", "date_only": false, "value": "2026-10-14T06:00:12.277Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / WPScan", "record": "CVE-2026-108066", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T07:17:02Z", "date_only": false, "value": "2026-10-14T07:17:02Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-PXWP-79FP-HGFV", "record": "GHSA-PXWP-79FP-HGFV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T07:17:02.303Z", "date_only": false, "value": "2026-10-14T07:17:02.303", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108066", "record": "FKIE_CVE-2026-108066", "field": "published"}, {"timestamp": "2026-10-14T09:31:31Z", "date_only": false, "value": "2026-10-14T09:31:31Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PXWP-79FP-HGFV", "record": "GHSA-PXWP-79FP-HGFV", "field": "published"}, {"timestamp": "2026-10-14T17:10:40.476Z", "date_only": false, "value": "2026-10-14T17:10:40.476581Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440370437468971", "record": "CVE-2026-108066", "field": "creation_timestamp", "uuid": "6f5f80a2-3de5-4c6e-bfc3-808f88fc4bc8", "content": "CVE-2026-108066 WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR The WP 2FA  WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108066https://wpscan.com/vulnerability/a41461a7-c9f4-4d80-9f15-1ab934206de8/#CVE_2026_108066#bot", "url": "https://infosec.exchange/users/cve/statuses/117440370437468971"}, {"timestamp": "2026-10-15T10:32:05.394Z", "date_only": false, "value": "2026-10-15T10:32:05.394111Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-108066", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-10-15T10:32:05.394Z", "date_only": false, "value": "2026-10-15T10:32:05.394111Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108066", "record": "FKIE_CVE-2026-108066", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T10:32:08.873Z", "date_only": false, "value": "2026-10-15T10:32:08.873Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-108066", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T10:32:08.873Z", "date_only": false, "value": "2026-10-15T10:32:08.873Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-108066", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T11:17:19.510Z", "date_only": false, "value": "2026-10-15T11:17:19.510", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108066", "record": "FKIE_CVE-2026-108066", "field": "lastModified"}, {"timestamp": "2026-10-15T12:30:55Z", "date_only": false, "value": "2026-10-15T12:30:55Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-PXWP-79FP-HGFV", "record": "GHSA-PXWP-79FP-HGFV", "field": "modified"}]}