Cross-Site Request Forgery Vulnerability in Google Authenticator WordPress Plugin
CVE-2026-14204
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 6 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14204?
The Google Authenticator WordPress plugin prior to version 0.56 is vulnerable to a Cross-Site Request Forgery (CSRF), which can be exploited to compromise two-factor authentication settings. Attackers can send a malicious request to a logged-in user, tricking them into changing their two-factor authentication secret to a value controlled by the attacker. This vulnerability not only risks unauthorized access to user accounts but also potentially locks users out of their own accounts, increasing the impact of the exploit.
Affected Version(s)
Google Authenticator 0 < 0.56
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.