Description
The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.
CVSS 6.5EPSS 0.122%Risk 0.66
View source- Published
- 2026-08-06 07:16:27
- Last modified
- 2026-08-06 22:16:45
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N