cve/2018/CVE-2018-20231.md

### [CVE-2018-20231](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20231)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.

### POC

#### Reference
- https://wpvulndb.com/vulnerabilities/9187
- https://wpvulndb.com/vulnerabilities/9187
- https://www.privacy-wise.com/two-factor-authentication-cross-site-request-forgery-csrf-vulnerability-cve-2018-20231/
- https://www.privacy-wise.com/two-factor-authentication-cross-site-request-forgery-csrf-vulnerability-cve-2018-20231/

#### Github
No PoCs found on GitHub currently.