In the WordPress ecosystem, security plugins are the first line of defense. However, when they fail, the impact can be critical.

In this article, we analyze a Cross-Site Request Forgery (CSRF) vulnerability in the Google Authenticator plugin (<= 0.55) that allows something extremely severe:

Overwrite an administrator’s 2FA secret without their consent.

Technical Summary

• Affected Plugin: Google Authenticator (WordPress)
• Version: <= 0.55
• CWE: CWE-352 (CSRF)
• Authentication Required: None (the victim must be logged in as an administrator)

function save_submitted_setup_page() { 
  $user = wp_get_current_user(); 
  $secret = empty($_POST['GA_secret']) ? '' : sanitize_text_field($_POST['GA_secret']); 
  $otp = empty($_POST['GA_otp_code']) ? '' : sanitize_text_field($_POST['GA_otp_code']); 
    if ($timeslot = $this->verify($secret, $otp, $relaxed_mode, '')) { 
    update_user_option($user->ID, 'googleauthenticator_secret', $secret, true); 
    update_user_option($user->ID, 'googleauthenticator_enabled', 'enabled', true); 
  } 
}

Root Cause

The developer completely omitted critical security controls:

• ❌ check_admin_referer()
• ❌ wp_verify_nonce()

This enables classic CSRF attacks against an extremely sensitive functionality: 2FA configuration.

Real-World Attack Scenario

The attack is not just theoretical — it is highly exploitable and, when combined with social engineering, results in full account takeover:

1. Attacker Preparation

• Generates a valid secret (e.g., KRUGS4ZANFZSA43B)
• Adds it to their own Google Authenticator app
• Sets up a phishing site

2. Social Engineering

• Sends an email such as: Critical 2FA security update required

3. Victim Interaction

• Adds the attacker’s secret to their app
• Generates a valid OTP
• Enters it into the malicious website

4. CSRF Execution

• The browser sends a legitimate POST request (without a nonce)
• WordPress accepts it as valid

5. Result

• The 2FA secret is replaced
• The admin is locked out
• The attacker gains full access

Attack Demonstration

Impact

• Full account takeover
• Persistence
• Complete 2FA bypass
• Loss of access for the legitimate administrator