WordPress / WordPress/two-factor
Stuck on revalidate now loop
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 825
- Forks
- 187
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 17
Description
Describe the bug
In cases where email doesn't work, the plugin is stuck in "Revalidate Now" mode. The solution may be to allow changing the authentication method without requiring validation if email is the primary and only method currently set up with the two-factor plugin.
Steps to Reproduce
Steps I took to reproduce the issue:
- I installed the plugin for the first time and chose email as the primary authentication method.
- The next time I logged into the WordPress Dashboard, I found that my website was not sending emails (an issue on the hosting side). To regain access, I logged in via SFTP and removed the plugin folder.
- Now, I want to switch from email to the authenticator app, but the plugin won't allow this because it requires me to "revalidate the session," which I can't do since email delivery is still not working on the website.
Screenshots, screen recording, code snippet
Environment information
- WordPress 6.6.1, Twenty Twenty Four theme
- Google Chrome browser on MacOS Sonoma
Please confirm that you have searched existing issues in this repository.
Yes
Please confirm that you have tested with all plugins deactivated except Two-Factor.
Yes
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are named. Start by reproducing the WordPress Dashboard flow with email as the only configured method and email delivery unavailable, then trace the revalidation and authentication-method settings flow. Done means the affected user can switch to an authenticator app without email validation in this specific recovery case, while normal validation behavior remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100