Breaking 2FA in WordPress: Account Takeover via CSRF in Google Authenticator

In the WordPress ecosystem, security plugins are the first line of defense. However, when they fail, the impact can be critical.

In this article, we analyze a Cross-Site Request Forgery (CSRF) vulnerability in the Google Authenticator plugin (<= 0.55) that allows something extremely severe:

Overwrite an administrator’s 2FA secret without their consent.

Technical Summary

• Affected Plugin: Google Authenticator (WordPress)
• Version: <= 0.55
• CWE: CWE-352 (CSRF)
• Authentication Required: None (the victim must be logged in as an administrator)

function save_submitted_setup_page() { 
  $user = wp_get_current_user(); 
  $secret = empty($_POST['GA_secret']) ? '' : sanitize_text_field($_POST['GA_secret']); 
  $otp = empty($_POST['GA_otp_code']) ? '' : sanitize_text_field($_POST['GA_otp_code']); 
  
  if ($timeslot = $this->verify($secret, $otp, $relaxed_mode, '')) { 
    update_user_option($user->ID, 'googleauthenticator_secret', $secret, true); 
    update_user_option($user->ID, 'googleauthenticator_enabled', 'enabled', true); 
  } 
}

Root Cause

The developer completely omitted critical security controls:

• ❌ check_admin_referer()
• ❌ wp_verify_nonce()

This enables classic CSRF attacks against an extremely sensitive functionality: 2FA configuration.

Real-World Attack Scenario

The attack is not just theoretical — it is highly exploitable and, when combined with social engineering, results in full account takeover:

1. Attacker Preparation

• Generates a valid secret (e.g., KRUGS4ZANFZSA43B)
• Adds it to their own Google Authenticator app
• Sets up a phishing site

2. Social Engineering

• Sends an email such as: Critical 2FA security update required

3. Victim Interaction

• Adds the attacker’s secret to their app
• Generates a valid OTP
• Enters it into the malicious website

4. CSRF Execution

• The browser sends a legitimate POST request (without a nonce)
• WordPress accepts it as valid

5. Result

• The 2FA secret is replaced
• The admin is locked out
• The attacker gains full access

Attack Demonstration

Impact

• Full account takeover
• Persistence
• Complete 2FA bypass
• Loss of access for the legitimate administrator

Breaking 2FA in WordPress: Account Takeover via CSRF in Google Authenticator was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.