CVE-2018-20231

Vulnerability

The Two Factor Authentication plugin before version 1.3.13 for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in the tfa_enable_tfa parameter handling. The plugin fails to include a nonce (number used once) in the request that toggles two-factor authentication (2FA) for the current user's account. This allows an attacker to forge a request that disables 2FA without the victim's knowledge. The affected versions are those prior to 1.3.13 [1][3].

Exploitation

An attacker must trick an authenticated WordPress administrator (or any user with 2FA enabled) into visiting a crafted link or page while they are logged into the WordPress admin panel. The attacker does not need any special network position or authentication; the exploit leverages the victim's active session. The attacker crafts a request (e.g., via an ` tag, a form submission, or an XHR) targeting the plugin's settings endpoint with tfa_enable_tfa=0`. If the victim clicks the malicious link or loads the attacker-controlled page, the browser sends the forged request with the victim's cookies, and the plugin processes it as a legitimate request to disable 2FA for that user [3].

Impact

Successful exploitation disables two-factor authentication for the victim user, stripping away the second authentication factor. This reduces login security to a single password, making the account more vulnerable to password-based attacks such as phishing, credential stuffing, or brute force. An attacker who later compromises the victim's password can log in without needing the one-time code. The impact is limited to disabling 2FA for the targeted user; the attacker does not directly gain access or escalate privileges through this CSRF alone [3].

Mitigation

The vulnerability was fixed in version 1.3.13 of the plugin [1]. Users should update to this version or later immediately. No workaround is available other than updating, as the fix introduces proper nonce validation on the affected endpoint. The plugin is actively maintained, and later versions (e.g., 1.16.0 as of March 2025 [2]) include this and other security improvements. This CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication [1][2][3].