CVE-2026-14204: Google Authenticator WordPress CSRF Flaw

CVE-2026-14204 Overview

CVE-2026-14204 is a Cross-Site Request Forgery (CSRF) vulnerability in the Google Authenticator WordPress plugin in versions before 0.56. The plugin fails to verify a CSRF nonce when saving its two-factor authentication setup. An attacker can craft a malicious page that, when visited by a logged-in WordPress user, silently submits a request that overwrites the victim's stored two-factor authentication (2FA) secret with an attacker-controlled value. The plugin then enables 2FA on the account. The legitimate user is locked out because they cannot generate valid one-time codes, while the attacker retains the seed needed to log in.

Critical Impact
Attackers can hijack the 2FA configuration of any logged-in WordPress user, lock the victim out of their account, and authenticate as the victim using the attacker-controlled seed.

Affected Products

Google Authenticator WordPress plugin versions prior to 0.56
WordPress sites using this plugin for two-factor authentication
Any user role on affected sites that can access the 2FA setup form

Discovery Timeline

2026-08-06 - CVE-2026-14204 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-14204

Vulnerability Analysis

The Google Authenticator WordPress plugin exposes a settings endpoint that persists a user's Time-based One-Time Password (TOTP) shared secret. The endpoint does not validate a WordPress nonce (wp_verify_nonce) or any equivalent anti-CSRF token when processing the save request. Any authenticated session can therefore be abused by a cross-origin request originating from an attacker-controlled page.

Because WordPress relies on session cookies scoped to the site, a browser visiting an attacker's page while logged into the target WordPress site will automatically attach those cookies to a forged POST request. The plugin accepts the submission and writes the attacker's chosen TOTP secret and 2FA enablement flag into the user's profile. The victim's authenticator app no longer produces valid codes, effectively denying them access, while the attacker holds the seed required to derive valid codes.

Root Cause

The root cause is missing CSRF token validation on the 2FA configuration save handler. The plugin trusts that any request carrying a valid authentication cookie is intentional, which is the exact assumption CSRF exploits. There is no check_admin_referer() or wp_verify_nonce() gate on the state-changing action.

Attack Vector

Exploitation requires the victim to be logged into the WordPress site and to visit a page controlled by the attacker, or to load attacker-controlled content embedded elsewhere. The malicious page issues an auto-submitting form or fetch() request targeting the plugin's 2FA save endpoint, supplying an attacker-generated TOTP secret and setting the enablement flag. No credentials, existing 2FA code, or password re-entry is required. The attack succeeds silently, with the victim discovering the compromise only when they attempt to log in and their authenticator app codes are rejected. A technical description is available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-14204

Indicators of Compromise

Unexpected changes to the googleauthenticator_* user meta fields, particularly the stored TOTP secret and the enablement flag.
User reports of being locked out of WordPress despite entering the correct password.
Referer headers on 2FA setup submissions pointing to external, non-WordPress origins.
New successful logins from unusual IP addresses immediately following a silent 2FA reconfiguration.

Detection Strategies

Audit WordPress usermeta history for unauthorized modification of Google Authenticator secret fields.
Correlate account lockout support tickets with recent HTTP POSTs to the plugin's profile update endpoint.
Alert on POST requests to profile.php or the plugin's AJAX action where the Referer header is off-site or absent.

Monitoring Recommendations

Enable WordPress audit logging for user meta changes and administrative profile updates.
Forward web server access logs to a central analytics platform and search for 2FA-related endpoints without matching prior GET requests from the same session.
Monitor authentication failures per user account to identify victims who suddenly cannot pass 2FA challenges.

How to Mitigate CVE-2026-14204

Immediate Actions Required

Update the Google Authenticator WordPress plugin to version 0.56 or later on all affected sites.
Review all user accounts for unexpected 2FA reconfiguration and reset TOTP secrets for any suspicious entries.
Require administrators and privileged users to re-enroll their authenticator devices after patching.
Invalidate active WordPress sessions to force re-authentication following remediation.

Patch Information

The vendor addressed the issue in Google Authenticator WordPress plugin version 0.56 by adding CSRF nonce verification to the 2FA setup save handler. Details are documented in the WPScan Vulnerability Report.

Workarounds

If patching is not immediately possible, disable the Google Authenticator WordPress plugin until it can be updated.
Restrict access to /wp-admin/ using IP allow-lists or a web application firewall rule set to block cross-origin POSTs lacking a valid Referer.
Instruct users to log out of the WordPress admin interface when not actively administering the site to reduce CSRF exposure.

bash

# Example WAF rule concept: block cross-origin POSTs to profile.php
# (adjust to your WAF syntax; illustrative only)
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1002026,msg:'Blocked cross-origin POST to WP profile'"
  SecRule REQUEST_URI "@rx /wp-admin/profile\.php" "chain"
  SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-wordpress-site.example/"