CVE-2018-20231

HIGH 8.8CVE-2018-20231 · Published 19/12/2018 · updated 17/06/2026

In short

CVE-2018-20231 is a HIGH (CVSS 8.8) vulnerability affecting two-factor-authentication (simbahosting).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 73.3% of all vulnerabilities.
Fix: update to 1.3.13 or later.

Package	Affected versions	Patched versions
two-factor-authentication simbahosting	`< 1.3.13`	`1.3.13`

Description

Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.

References

wordpress.org/plugins/two-factor-authentication · Third Party Advisory
wpvulndb.com/vulnerabilities/9187 · Third Party Advisory
privacy-wise.com/two-factor-authentication-cross-site-request-forgery-csrf-vulnerability-cve-2018-20231 · Exploit

More vulnerabilities in two-factor-authentication

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free