CVE-2026-14204 | BDVDB-2026-355752 Detail

Description#

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-06Record published in the CVE List.