Bug Report – 2FA Reset Function Leaves Corrupted Data Causing Login Issues

Hi WPMU DEV Support,

I’ve discovered a bug in Defender Security’s “Reset two factor” functionality that leaves users in a corrupted state and unable to log in.

Environment:

• Defender Security version: 5.6.1
• WordPress version: 6.8.3

Issue Description: When an administrator uses the “Reset two factor” link from the Users list page (wp-admin/users.php) and that user only has “fallback email” set up for authentication, it only partially clears the user’s 2FA data. This leaves the user unable to log in and the option to reset 2FA disappears from the user interface.

Steps to Reproduce:

1. User sets up 2FA using the Fallback Email method
2. Administrator clicks “Reset two factor” link for that user from Users list
3. User attempts to log in – experiences issues or gets stuck in 2FA loop
4. When user (or admin) views the user page in the admin, there are no details about enabled 2FA options nor link to reset 2FA
5. In database, wd_2fa_default_provider and wd_2fa_enabled_providers are empty, but other 2FA meta remains

Root Cause: The reset function in src/component/class-two-fa.php at lines 810-811 only clears two user meta fields:

update_user_meta( $user_id, self::DEFAULT_PROVIDER_USER_KEY, '' );
update_user_meta( $user_id, self::ENABLED_PROVIDERS_USER_KEY, '' );

However, it leaves behind:

• wd_2fa_backup_email (stored as defenderAuthEmail)
• wd_2fa_backup_code (stored as defenderBackupCode)
• defender_two_fa_token
• wd_2fa_attempt_fallback-email

This partial cleanup creates a corrupted state where Defender thinks 2FA is disabled (empty providers) but authentication tokens and secrets still exist.

Expected Behavior: The reset function should delete ALL 2FA-related user meta, similar to how the remove_data() function works in src/controller/class-two-factor.php (lines 1053-1070).

Database Evidence: For the affected user, we found:

• wd_2fa_default_provider: empty
• wd_2fa_enabled_providers: empty
• defenderAuthEmail: still has email address
• defenderBackupCode: still has serialized backup codes
• defender_two_fa_token: still has active token
• wd_2fa_attempt_fallback-email: still has attempt counter

Temporary Workaround: We resolved the issue by manually deleting all 2FA meta for the affected user via phpMyAdmin.

Suggested Fix: The admin_notices() method should call a comprehensive cleanup function that removes all 2FA data for the user, not just the two provider fields. Consider creating a helper method like clear_user_2fa_data($user_id) that can be reused in multiple places.

Impact: Users affected by this bug cannot log in and may be completely locked out if they don’t have database access. This is a critical issue for production sites.

Please let me know if you need any additional information or access to reproduce this issue.

Thank you!