CVE-2026-14204 is a CSRF vulnerability in the Google Authenticator WordPress plugin prior to version 0.56. The plugin fails to verify a CSRF nonce during the process of saving the two-factor authentication setup. This flaw allows an attacker to coerce a logged-in user into replacing their 2FA secret with one controlled by the attacker. As a result, the attacker can enable two-factor authentication on the victim's account using their own secret, effectively locking the legitimate user out of their account.

The vulnerability allows an attacker to cause a logged-in user to unknowingly overwrite their two-factor authentication secret with an attacker-controlled value. This leads to the attacker enabling two-factor authentication on the victim's account, which locks the victim out and denies them access. There is no direct confidentiality or availability impact stated, but the integrity of the victim's account access is compromised.

No official fix or patch is currently confirmed for this vulnerability. Users should monitor the vendor advisory for updates and apply any official patches once available. Until then, caution should be exercised when interacting with untrusted links or sites while logged into WordPress with this plugin. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.