CVE-2018-20231

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Two-factor-authentication
Vendor
CVE Published:
19 December 2018

Summary

Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.

References

https://www.privacy-wise.com/two-factor-authentication-cr...
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9187
x_refsource_MISC
https://wordpress.org/plugins/two-factor-authentication/#...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.