Clearing auth cookies when visiting wp-login.php while being already logged-in #659
Description
Describe the bug
When a user who is logged-in (and has two-factor configured) visits the wp-login.php page, their authentication state is cleared. The clearing should happen only during the two-factor login workflow.
By default, WP core redirects users to the dashboard if they visit wp-login.php while being already logged in. This is not happening and prevents other plugins that rely on the logged-in state on the wp-login.php page from functioning.
This happens because the function attached to wp_login is running the logic even outside of the login flow:
two-factor/class-two-factor-core.php
Lines 641 to 653 in 80e76ef
Steps to Reproduce
- Login at a site.
- Configure and enable any two-factor method.
- Visit /wp-login.php and notice that a login form is shown or just the two-factor prompt.
Screenshots, screen recording, code snippet
Environment information
- Two-factor 0.11.0
- Default theme 2025
- No other plugins
Please confirm that you have searched existing issues in this repository.
Yes
Please confirm that you have tested with all plugins deactivated except Two-Factor.
Yes