CVE-2026-14204

Name of the Vulnerable Software and Affected Versions Google Authenticator WordPress plugin versions prior to 0.56

Description The plugin fails to verify a CSRF (Cross-Site Request Forgery) nonce—a unique token used to prevent unauthorized requests—when saving the two-factor authentication setup. This allows an attacker to trick an authenticated user into overwriting their 2FA secret with a value controlled by the attacker, effectively enabling two-factor authentication and locking the user out of their account.

Recommendations Update the Google Authenticator WordPress plugin to version 0.56 or later.