CVE-2026-14204: Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF
The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Google Authenticatorto a version that resolves this vulnerability.Fixed in 0.56 - Compensating control
Ensure the WordPress admin/authenticated routes that save the Google Authenticator 2FA setup are protected against CSRF (e.g., enforce/require CSRF nonces on the save endpoint) to prevent overwriting the 2FA secret via forged requests.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14204?
CVE-2026-14204 has a risk rating of 45, indicating a moderate severity level.
How do I fix CVE-2026-14204?
To fix CVE-2026-14204, update the Google Authenticator WordPress plugin to version 0.56 or later.
What type of vulnerability is CVE-2026-14204?
CVE-2026-14204 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
Who is affected by CVE-2026-14204?
CVE-2026-14204 affects users of the Google Authenticator WordPress plugin versions prior to 0.56.
What can attackers do with CVE-2026-14204?
Attackers can exploit CVE-2026-14204 to overwrite a user's two-factor authentication secret, potentially locking the user out of their account.