Skip to content
Sign in
6.5 Medium

CVE-2026-14204 The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup,…

Description

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.

Affected products and versions

Product Affected versions Fixed in
Google Authenticator 0.56 earliest → < 0.56 0.56

Other CVEs of Google Authenticator

The 2 CVEs of Google Authenticator →
CVE-2022-0875 The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not… Not rated
Track this CVE