CVE-2026-14204: CWE-352 Cross-Site Request Forgery (CSRF) in Google Authenticator
The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.
AI Analysis
Technical Summary
CVE-2026-14204 is a CSRF vulnerability in the Google Authenticator WordPress plugin prior to version 0.56. The lack of CSRF nonce verification when saving the two-factor authentication setup allows an attacker to cause a logged-in user to unknowingly replace their 2FA secret with one chosen by the attacker. This effectively enables the attacker to take control of the victim's two-factor authentication, potentially locking the victim out of their own account.
Potential Impact
An attacker can exploit this vulnerability to overwrite a victim's two-factor authentication secret with an attacker-controlled value. This enables the attacker to bypass or control the victim's 2FA protection, potentially locking the victim out of their account and compromising account security.
Mitigation Recommendations
No official patch or remediation guidance is currently available. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is released, caution is advised when interacting with untrusted links or sites while logged into WordPress with this plugin installed.
CVE-2026-14204: CWE-352 Cross-Site Request Forgery (CSRF) in Google Authenticator
Description
The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-14204 is a CSRF vulnerability in the Google Authenticator WordPress plugin prior to version 0.56. The lack of CSRF nonce verification when saving the two-factor authentication setup allows an attacker to cause a logged-in user to unknowingly replace their 2FA secret with one chosen by the attacker. This effectively enables the attacker to take control of the victim's two-factor authentication, potentially locking the victim out of their own account.
Potential Impact
An attacker can exploit this vulnerability to overwrite a victim's two-factor authentication secret with an attacker-controlled value. This enables the attacker to bypass or control the victim's 2FA protection, potentially locking the victim out of their account and compromising account security.
Mitigation Recommendations
No official patch or remediation guidance is currently available. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is released, caution is advised when interacting with untrusted links or sites while logged into WordPress with this plugin installed.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-06-30T09:37:38.620Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a742932bf8831d53945d6b1
Added to database: 08/06/2026, 06:26:58 UTC
Last enriched: 08/06/2026, 07:00:33 UTC
Last updated: 08/07/2026, 02:05:10 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.