CVE-2018-20231: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfaenabletfa parameter due to missing nonce validation...

PT-2018-15298

Name of the Vulnerable Software and Affected Versions WordPress two-factor-authentication plugin versions prior to 1.3.13 Description The issue allows remote attackers to disable two-factor authentication 2FA due to missing nonce validation. This can be achieved by exploiting the tfa enable tfa...