WordPress two-step authentication login plug-in Security Vulnerability

Since 2013, with the frequent occurrence of website data leaks, more and more websites have begun to provide two-step authentication (two-factor authentication) technology to improve the security of user accounts, wordPress, the world's largest blog platform, implements two-step Authentication through third-party plug-ins similar to duo_wordpress.

Recently, duo_wordpress developer, enterprise-level mobile Security Duo Security, revealed that the plug-in has a Security vulnerability. Users can bypass two-step authentication when logging on to a website in the same website group and redirecting to another website.

When administrators manage multiple websites in a single background and deploy duo_wordpress plug-in for each website, the above security problems will occur. If duo_wordpress is deployed on multiple websites in a single background, this problem will not occur.

According to Duo Security, this Security vulnerability in the company's WordPress two-step authentication plug-in will also affect third-party two-step authentication vendor plug-ins, we recommend that all WordPress administrators who deploy two-step authentication check system security issues.

Duo Security provides the following suggestions on the official website:

A multi-site WordPress platform contains two sites: Site 1 and Site 2. Site 1 enables Duo WordPress plug-in while Site 2 does not, when a user logs on to site 1, two-step authentication is required. When logging on to Site 2, you only need to enter the common account password. However, when a user of Site 1 first logs on to the login page of Site 2, will be authenticated and redirected to site 1, that is to say, the two-step authentication is automatically obtained by site 1.
Duo Security provides a solution to enable two-step authentication in the global scope, and then disable two-step authentication for individual sites, instead of disabling global authentication and then separately deploying two-step authentication for individual sites.