Google Authenticator CVE-2026-14204

The victim must be actively logged into a WordPress session on a site running the Google Authenticator plugin (any version before 0.56) at the time of the attack. The attacker must deliver a malicious page or link to the victim and induce them to load it - this is the UI:R interaction in the CVSS vector and the reason SSVC classifies it as not automatable. No attacker-side authentication or privileges are required. Exploitation is limited by: the need for victim interaction (cannot be mass-automated); the attacker must have reason to know the target uses this specific plugin; and the victim must be in an active WordPress session. The vulnerability can be exploited against users who have not yet configured 2FA, force-enrolling them with an attacker-controlled secret, as well as against users who already have 2FA active.

The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) is consistent with the mechanics: network-delivered, low complexity, but contingent on a single required user interaction (visiting an attacker-controlled page while logged in). The high integrity impact captures the complete replacement of the victim's 2FA secret. EPSS at 0.11% (2nd percentile) and SSVC 'not automatable' both indicate mass exploitation is unlikely - each attack requires a targeted phishing step against a specific authenticated user. The existence of a public POC (WPScan exploit reference) elevates this above theoretical, enabling motivated, targeted actors. The account-lockout consequence is operationally severe for victims but blast radius per attack is limited to one user. No CVSS/description conflict identified. Primary risk is targeted account takeover or denial of access against specific high-value WordPress users running this plugin.

An attacker crafts a hidden HTML form on an attacker-controlled page that, when loaded, auto-submits a 2FA setup request to the target WordPress site containing a TOTP secret the attacker has pre-generated. A phishing email is sent to a WordPress user with a pretext to click the link; when the victim loads the page while logged into WordPress, the forged request fires silently, replacing their 2FA secret with the attacker's value. A public POC demonstrating this technique is documented in the WPScan advisory.