Security Alert Summary
The Google Authenticator WordPress plugin prior to version 0.56 fails to verify a CSRF nonce when saving its two-factor setup. An attacker can trick a logged-in user into overwriting their 2FA secret with an attacker-controlled value, which enables two-factor authentication for the account and can lock the legitimate user out of their account.
CVE Details
- CVE ID: CVE-2026-14204
- Affected component: Google Authenticator WordPress plugin
- Affected versions: Versions before 0.56
- Published: August 6, 2026 at 7:16:27 AM UTC
- Last modified: August 6, 2026 at 7:16:27 AM UTC
- CVSS v3.1 base score / severity / vector: Not provided
- Authentication / privileges / user interaction: The issue requires a logged-in user to be tricked; no CVSS authentication details provided. No elevated privileges are specified in the available data.
- Primary impact:
- Confidentiality: Not indicated
- Integrity: Modification of a user’s two-factor authentication secret
- Availability: Legitimate user may be locked out of their account
- CWE / weakness ID: Not provided
Technical Details
According to the vulnerability description, the plugin does not verify a CSRF nonce when saving its two-factor setup. This missing server-side check allows an attacker to cause a logged-in user to submit a request that replaces that user’s 2FA secret with a value controlled by the attacker. The description specifically identifies the lack of CSRF nonce verification during the two-factor setup save operation as the root cause.
Impact, as described, is limited to enabling two-factor authentication with an attacker-controlled secret and preventing the legitimate user from accessing their account. No specific functions, REST API endpoints, or other implementation details are provided in the available data.
How This Could Impact Your Website
Consider a small WordPress site with an owner, an editor on staff, and an external contractor who helps with content. If an attacker successfully tricks one of these authenticated users into submitting the malicious request, the attacker-controlled 2FA secret could be set for that account. The immediate consequence is that the legitimate user may be unable to log in, disrupting normal operations and requiring account recovery steps.
Practical consequences can include increased administrative overhead to restore access, temporary loss of access for staff who need to manage content or respond to customers, and a heightened risk of targeted phishing or social engineering attempts aimed at recovering or exploiting locked accounts. Exposure of internal user email addresses is not specified by the vulnerability itself, but any disruption to account access can increase opportunities for follow-on social engineering.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators (using a trusted, updated plugin).
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, especially authentication and user-setting changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
