When someone is locked out

Turn two-factor off for one user

$ wp u2auth disable romaan
Success: Two-factor disabled for user 1.

It is a positional argument, not --user=

<user> is a WordPress user id, login, or email address, resolved in that order. It is not passed as --user=. WP-CLI reserves --user as one of its own global parameters — it sets the acting WP-CLI user and is consumed before any command sees it — so an earlier form of this command that took --user=<id> never worked at all: the value was swallowed and the command resolved nobody. That form is now rejected outright rather than failing silently.

$ wp u2auth status --user=1
usage: wp u2auth status <user>

Check the state without changing it

$ wp u2auth status romaan
user 1: linked=no recovery_codes_remaining=8

Useful for confirming a rescue actually landed, and for seeing how close a user is to running out of codes.

What disable actually does

• Clears the local WordPress state that gates the challenge: the linked flag, the stored TOTP secret, and any pending challenge nonce.
• Clears the enforcement grace timestamp as well, so a rescued user in an enforced role gets a fresh window instead of being refused again on their very next sign-in by a stale, already-expired one.
• Touches nothing on the U2 side and makes no network call at all. That is deliberate: the command exists for the case where U2 might be unreachable, so it cannot depend on reaching it.
• Leaves the remote enrolment in place. It is harmless, and the user can unlink it properly from their profile screen once they are back in.

The user can then sign in with their password alone, and re-link from their profile whenever they are ready.