CVE-2018-20231 Two Factor Authentication <= 1.3.12 - Cross-Site Request Forgery
HighCVSS 8.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simbahosting two-factor-authentication | < 1.3.13 | 1.3.13 |
| wordpress two-factor-authentication(WordPress) | < 1.3.13 | 1.3.13 |
References
- wordpress.org third-party-advisory
- wpvulndb.com third-party-advisory
- www.privacy-wise.com exploit third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org