Cross-Site Request Forgery Vulnerability in WP 2FA Plugin for WordPress

CVE-2023-6520

Summary

The WP 2FA plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), impacting all versions up to and including 2.5.0. The vulnerability stems from improper nonce validation in the 'send_backup_codes_email' function, which allows unauthenticated attackers to send emails containing arbitrary content to registered users. If an attacker can deceive a site administrator or a registered user into performing an action, such as clicking on a malicious link, they can exploit this flaw. Although a nonce check is implemented, it is only executed when a nonce is provided. Consequently, if a request lacks a nonce, the check is bypassed, leaving users vulnerable to this attack.

References