Last updated
A user who can't get a 2FA code can log in with one of their backup codes, or have an administrator reset their 2FA from their profile.
With a Backup Code
Enter a backup code, without the space, on the 2FA screen instead of a code from the app or email. Then, on the profile, turn 2FA off with your password and set it up again, or switch to email codes if the site allows them. Each backup code works once.
Without a Backup Code
An administrator can turn 2FA off for the user. Under Users, edit the user and click "Reset 2FA" in the Two-Factor Authentication section, which also shows whether 2FA is on and which method the user has. This discards their secret key and backup codes, so they can log in with just their password and set 2FA up again.
If no administrator can get in, someone with access to the server can reset a user with WP-CLI, replacing jane with the user's username:
wp user meta delete jane _tml_2fa_enabled
wp user meta delete jane _tml_2fa_secret
wp user meta delete jane _tml_2fa_method
Without WP-CLI, rename the extension's folder, usually wp-content/plugins/tml-2fa, over FTP or your host's file manager. That turns the extension off, and everyone logs in with just a password. Once you're in, rename the folder back. If Theme My Login 2FA shows as inactive on the Plugins screen (Network Admin → Plugins on multisite), activate it again. Then reset the locked-out user's 2FA from their profile, or turn off your own with your password, and set it up again.
Stuck on the Profile Page
"2FA is required for your account and must be enabled below before you may proceed." means your role is one of the Required Roles. Set up 2FA on the profile it shows you, and the rest of the site opens up.
If setup can't be finished, an administrator who has 2FA on can uncheck the role. Or, with WP-CLI, clear the setting entirely:
wp option delete tml_2fa_required_roles
On a multisite network, use wp site option delete tml_2fa_required_roles instead.