CVE-2023-6520

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the send_backup_codes_email function. This makes it possible for unauthenticated attackers to send emails with arbitrary content to registered users via a forged request granted they can trick a site administrator or other registered user into performing an action such as clicking on a link. While a nonce check is present, it is only executed if a nonce is set. By omitting a nonce from the request, the check can be bypassed.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/wp-2fa/trunk/includes/classes/Admin/class-setup-wizard.php?rev=2940688#L606Issue Tracking
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009922%40wp-2fa&new=3009922%40wp-2fa&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0af451be-2477-453c-a230-7f3fb804398b?source=cvePatch, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/wp-2fa/trunk/includes/classes/Admin/class-setup-wizard.php?rev=2940688#L606Issue Tracking
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3009922%40wp-2fa&new=3009922%40wp-2fa&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0af451be-2477-453c-a230-7f3fb804398b?source=cvePatch, Third Party Advisory

Published

Jan 11, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6514 The Bluetooth module of some Huawei Smart Screen products h…8.8
• CVE-2023-6515Authorization Bypass Through User-Controlled Key vulnerabili…8.8
• CVE-2023-6516To keep its cache database efficient, `named` running as a r…7.5
• CVE-2023-6517Exposure of Sensitive Information Due to Incompatible Polici…7.5
• CVE-2023-6518Plaintext Storage of a Password vulnerability in Mia Technol…7.5
• CVE-2023-6519Exposure of Data Element to Wrong Session vulnerability in M…7.5
• CVE-2023-6522Incorrect Use of Privileged APIs vulnerability in ExtremePac…7.2
• CVE-2023-6523Authorization Bypass Through User-Controlled Key vulnerabili…8.8
• CVE-2023-6524The MapPress Maps for WordPress plugin for WordPress is vuln…5.4
• CVE-2023-6525The ElementsKit Elementor addons plugin for WordPress is vul…4.8
• CVE-2023-6526The Meta Box – WordPress Custom Fields Framework plugin for …5.4
• CVE-2023-6527The Email Subscription Popup plugin for WordPress is vulnera…6.1