Google Authenticator Plugin Bug Allows Attackers to Hijack Two-Factor Authentication

A critical vulnerability has been discovered in the Google Authenticator WordPress plugin, allowing attackers to overwrite a logged-in user's two-factor secret without stealing their password.

The bug, tracked as CVE-2026-14204, affects all versions before 0.56 and is considered medium-severity with a CVSS v3.1 score of 6.5.

According to the security researcher's disclosure, the flaw allows an attacker to craft a malicious link or form that, when opened by a logged-in user, silently submits a forged request to the plugin.

The request lacks nonce verification, allowing the attacker to replace the victim's stored TOTP secret with a value they already know.

This enables the attacker to generate valid codes for the account, while the legitimate user is locked out of their own two-factor protection.