PT-2026-79515 · WordPress · Firebase Otp Authentication
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Firebase Authentication WordPress plugin versions prior to 1.7.1
Description
An issue exists where the plugin fails to verify the email address within an authentication token before matching it to a WordPress account and issuing a session. This allows unauthenticated attackers to log in as any user, including those with administrator privileges.
Recommendations
Update the Firebase Authentication WordPress plugin to version 1.7.1 or later.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Firebase Otp Authentication