Super Admin 2FA | WordPress.org

Hi,

I’m adding all the available roles by adding this to the functions.php:

<?php

// Add all roles to 2fa authentication
add_filter( 'sg_security_2fa_roles', 'add_all_roles_to_2fa' );
function add_all_roles_to_2fa( $roles ) {
    $wp_roles = wp_roles();
    $roles = array_keys( $wp_roles->roles );
    return $roles;
}

I noticed that once you are a Super Admin in a Multisite Network and haven’t been assigned to a subsite you can login without using 2FA. Once you add a Super Admin to a subsite the user needs to setup their 2FA.

This is a serious security flaw to enable it for administrators and editors but not for Super Admins who aren’t assigned to a subsite. Is there a way to activate 2FA for all super admins who aren’t assigned to a subsite?