An attacker identified that a user and an access point are both compatible with WPA2 and WPA3 encryption. The attacker installed a rogue access point with only WPA2 compatibility in the vicinity and…

A timing-based attack exploits variations in execution time to infer cryptographic secrets and is unrelated to manipulating which security protocol a client selects.

A side-channel attack extracts information through indirect physical measurements such as power consumption or electromagnetic emissions, not through protocol negotiation manipulation.

A downgrade attack exploits backward compatibility by forcing a client to negotiate a weaker security standard than it is capable of. In this scenario, the attacker's rogue AP advertises only WPA2, causing the WPA3-capable client to fall back to WPA2 and complete a four-way handshake. The attacker can then capture the WPA2 handshake and crack it offline using automated tools, a vulnerability that WPA3's Simultaneous Authentication of Equals (SAE) was designed to prevent.

A cache-based attack targets CPU or application cache mechanisms to leak data, and has no relevance to forcing a wireless client to use a weaker encryption standard.