CVE-2018-20231

HIGH · CVSS 8.8 EPSS 1.44%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2018-12-19 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

CVE

CVE-2018-20231

Severity

HIGH

CVSS

8.8

EPSS

1.44%

WordPress

Original Filing — NVD Description

Cross Site Request Forgery (CSRF) in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfa_enable_tfa parameter due to missing nonce validation.