The Google Authenticator WordPress plugin (versions before 0.56) fails to check a CSRF nonce when a user saves two-factor settings. An attacker can exploit this by tricking a logged-in user into submitting a request that replaces the user’s legitimate 2FA secret with one chosen by the attacker. The result is that the victim can no longer log in with the original authenticator, effectively locking the user out and giving the attacker control over the account. The vulnerability is a genuine loss of confidentiality and integrity for the user’s account credentials, but it does not provide remote code execution or broader system compromise. The weakness is an omission of a CSRF nonce check, which maps to the cross-site request forgery concept.

WordPress sites that have the Google Authenticator plugin installed and running a version older than 0.56. No other vendors or products are affected by this specific issue.

The vulnerability can be exploited by any attacker who can convince a logged-in user to send a crafted POST request to the two-factor settings endpoint – for example, via a malicious link or embedded form. The CVSS score of 6.5 reflects a moderate severity. The EPSS score of < 1% indicates a very low but non-zero exploitation probability, yet the attack vector is common and easy to trigger, so the likelihood of exploitation remains moderate to high for exposed sites. The CVE is not listed in the CISA KEV catalog, suggesting no public exploit has yet been documented, but the potential for account takeover makes the issue immediately relevant to administrators.