CVE-2026-14204

The CVE concerns the Google Authenticator WordPress plugin prior to 0.56, where saving the 2FA setup does not verify a CSRF nonce. This allows a logged-in attacker to trick a user into overwriting their own 2FA secret with attacker‑controlled data, resulting in the attacker effectively controllin...