CVE-2022-0229

Name of the Vulnerable Software and Affected Versions miniOrange's Google Authenticator WordPress plugin versions prior to 5.5

Description The issue arises from the lack of proper authorization and CSRF checks when handling the reconfigureMethod, and improper validation of parameters passed to it. This allows unauthenticated users to delete arbitrary options from the blog, rendering it unusable.

Recommendations For versions prior to 5.5, update to version 5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the reconfigureMethod to prevent unauthorized modifications until a patch is applied.