Description

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-22T06:16:16.900Z",
  "pubdate": "2026-08-22T06:16:16.900Z",
  "executiveSummary": "The Firebase Authentication WordPress plugin prior to version 1.7.1 suffers from an authentication bypass vulnerability stemming from a failure to validate email address verification status within authentication tokens. This flaw permits unauthenticated malicious actors to arbitrarily authenticate as any registered user on the target WordPress installation, including high-privileged accounts such as administrators.\nThe vulnerability exposes the affected systems to severe risk, as successful exploitation results in complete administrative takeover of the WordPress site. The attack vector requires no prior authentication or specialized privileges, allowing remote threat actors to execute arbitrary actions, modify site content, or inject malicious code.\nThe core risk implication is unauthorized access and full system compromise. Exploitation depends on the plugin's flawed processing of Firebase authentication tokens where unverified email claims are improperly trusted for account association and session generation.",
  "technicalDetails": "The vulnerability resides within the session issuance and token processing logic of the Firebase Authentication WordPress plugin. The root cause of the flaw is the absence of a validation check ensuring that the email address contained within the provided authentication token has been cryptographically verified by the identity provider before proceeding with account matching.\nDuring the authentication flow, the plugin receives an authentication token from the client side. Instead of validating all security assertions—specifically the email verification flag (email_verified)—the plugin immediately searches for an existing WordPress user account matching the email address supplied in the token payload.\nUpon locating a corresponding user account based solely on the unverified email string, the plugin automatically generates and issues a valid WordPress session cookie for that user. This bypasses standard credential verification and identity confirmation mechanisms.\nThe attack flow proceeds as follows: First, an unauthenticated attacker obtains or generates an authentication token containing the target user's email address, such as an administrator's email, without completing the verification process. Second, the attacker submits this token to the vulnerable Firebase Authentication plugin endpoint handling login or token verification. Third, the plugin parses the token, extracts the email address, and matches it to the administrator account in the WordPress database without verifying the token's email verification status. Finally, the plugin establishes an active authenticated session, granting the attacker full administrative access to the WordPress backend.\nThe affected component is the token validation and session generation routine within the Firebase Authentication WordPress plugin for versions strictly prior to 1.7.1. The vulnerability is exploitable remotely over the network by unauthenticated attackers requiring zero privileges, leading directly to arbitrary account compromise and full administrative post-exploitation impact."
}