Invalidate the first session too (#329)

WordPress · Feb 5, 2020 · 8be7406 · 8be7406
1 parent e380d6a
commit 8be7406
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/class-two-factor-core.php b/class-two-factor-core.php
@@ -237,6 +237,7 @@ public static function wp_login( $user_login, $user ) {
 			return;
 		}
 
+		wp_destroy_current_session();
 		wp_clear_auth_cookie();
 
 		self::show_two_factor_login( $user );