as247

@technicalx Please try

wp2sv()->get(‘auth’)->setCookie($user_id, $remember) after
wp_set_auth_cookie( $user_id, $remember, ”, $new_token );

Hi joostgrunwald,

Thanks for your findings and concerns regarding the potential exposure of the TOTP secret to third-party QR code services.

Before version 2.6.3, the plugin used Google’s QR code API to generate QR codes. While this method exposed the TOTP secret to a third-party service via HTTP requests, the risk of Google actively intercepting or misusing this data is very low, given their reputation and business model.

Starting from version 2.6.3, we have switched to rendering QR codes entirely on the client side using JavaScript, without relying on any external QR code generation services. You can review the relevant code here:
https://plugins.trac.ww.wp.xz.cn/browser/wordpress-2-step-verification/tags/2.6.3/resources/js/components/authenticator.vue

Here is the key snippet responsible for rendering the QR code locally:

renderQrCodes() {
  let size = this.qr_size || 128;
  let qrCodeDivs = document.getElementsByClassName('wp2sv-qrcode-render');
  if (qrCodeDivs.length === 0 || typeof QRCode === 'undefined') {
    console.log('No QR code divs found or no data to render QR code', qrCodeDivs.length, typeof QRCode === 'undefined');
    return false;
  }
  try {
    for (let i = 0; i < qrCodeDivs.length; i++) {
      new QRCode(qrCodeDivs[i], {
        text: this.qr_data,
        width: size,
        height: size,
        correctLevel: QRCode.CorrectLevel.M,
      });
    }
    return true;
  } catch (e) {
    return false;
  }
}

The fallback to a third-party QR code image URL is included as a safety net but is almost never triggered in real usage.

Unused external QR code services were removed in version 2.6.4 to further reduce any risk.

Therefore, there is no vulnerability related to TOTP secret exposure via QR code generation.

That mean you input wrong code too many times, you can try again later or use recovery method.

I mean wp2sv app passwords, please check this

you should see there is an “app passwords” section

Just checked latest version and it’s working on my end. I think it may conflict with your plugins, could you try again with all other plugins disabled.

Hi. Please refrain from using the logout function, as it will also clear the remembered token.

Server and local time difference is normal, just verify time is correct.