EUVD-2026-53738
GHSA-5j77-9g8f-r5r2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attacker needs no credentials; victim interaction required; integrity-only impact via full 2FA secret replacement; no confidentiality or availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.
AnalysisAI
Cross-site request forgery in the Google Authenticator WordPress plugin before version 0.56 allows an unauthenticated attacker to overwrite a logged-in user's TOTP secret by tricking them into loading a malicious page. The forged request silently replaces the victim's two-factor secret with one the attacker controls, enabling the attacker to generate valid OTPs and lock the legitimate account owner out. A public proof-of-concept is available via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS of 0.11% (2nd percentile) aligns with SSVC's 'not automatable' designation.
Technical ContextAI
CWE-352 (Cross-Site Request Forgery) arises when a server-side endpoint performs state-changing operations without verifying a session-bound nonce. WordPress provides wp_nonce_field() and check_admin_referer() specifically to prevent this class of attack; this plugin omits that check on the two-factor setup save handler. Because browsers automatically attach session cookies to cross-origin requests, an attacker-controlled page can silently submit a forged form on behalf of any currently logged-in user. The affected product is identified by CPE cpe:2.3:a:unknown:google_authenticator:*:*:*:*:*:*:*:* covering all releases prior to 0.56, as reported by WPScan and reflected in EUVD-2026-53738.
RemediationAI
Update the Google Authenticator WordPress plugin to version 0.56 or later, which introduces CSRF nonce verification on the two-factor setup save endpoint - this is the vendor-confirmed fix per the WPScan advisory (https://wpscan.com/vulnerability/9ae793b2-31d4-4a9d-9481-52f07024b07e/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-14204). If immediate patching is not feasible, administrators can restrict access to the WordPress dashboard to trusted IP ranges, preventing cross-site requests from reaching the vulnerable endpoint - note this disrupts legitimate remote admin access. Alternatively, temporarily deactivating the plugin removes the attack surface entirely but also disables 2FA protection for all accounts on the site, which should be weighed as a trade-off.
More in Google Authenticator
View allThe miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks whe
Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress. Rated high severi
The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, l
The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not s
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator
The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capabi
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today