The youtag Two-factor authentication WordPress plugin (formerly IP Vault) contains a CSRF vulnerability due to improper nonce validation in the ipv_save_changes function. This allows attackers to perform unauthorized changes to security-related plugin settings by convincing an administrator to perform an action such as clicking a malicious link. The vulnerability affects all versions up to and including 2.1. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker can modify the plugin's firewall and two-factor authentication settings without authentication by exploiting this CSRF vulnerability. This can lead to disabling or weakening of security protections, potentially exposing the site to further attacks. The impact is limited to integrity as no confidentiality or availability impacts are reported. The attack requires user interaction (an administrator clicking a crafted link).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking links from untrusted sources and consider implementing additional CSRF protections or restricting administrative access. Monitor official youtag or WordPress plugin channels for updates.