Summary
CVE-2026-76793 is an authentication bypass vulnerability affecting the Firebase Authentication plugin for WordPress. Versions prior to 1.7.1 fail to verify that the email address embedded in a Firebase authentication token has actually been confirmed as verified before using it to match and log into a corresponding WordPress account. This flaw is rated HIGH severity (CVSS 3.1: 8.1) and allows an unauthenticated attacker to take over any WordPress account tied to a matching email, including administrator accounts.
Technical details
- Root cause: The plugin trusts the email claim inside a Firebase-issued authentication token to identify and log a user into WordPress, without first confirming that the email address associated with that token has been verified by Firebase.
- Trigger conditions: An attacker who can obtain or craft a Firebase authentication token containing an unverified email address matching a target WordPress account’s email can present it to the plugin’s login handler.
- Attack vector: Network-based (AV:N); the CVSS vector reflects high attack complexity (AC:H) and requires no privileges (PR:N) or user interaction (UI:N), meaning no valid credentials or victim action are needed for exploitation.
- Impact: Successful exploitation results in full impersonation of the targeted WordPress account, including potential administrator takeover, with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) — potentially leading to complete site compromise.
- Classification: CWE-287 (Improper Authentication).
Affected software
- Firebase Authentication WordPress plugin — all versions prior to 1.7.1
Severity
- CVSS v3.1 Base Score: 8.1 (HIGH)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Upgrade the Firebase Authentication WordPress plugin to version 1.7.1 or later, which enforces proper verification of the email claim in Firebase authentication tokens before account linking/login.
- If immediate patching is not possible:
- Temporarily disable the Firebase Authentication plugin to prevent token-based logins until the patch can be applied.
- Review WordPress user accounts and audit logs for suspicious logins or unexpected administrative activity that may indicate prior exploitation.
- Enforce additional authentication controls (e.g., two-factor authentication for administrator accounts) as a compensating control while patching is scheduled.
- Restrict or monitor exposure of the plugin’s authentication endpoints where feasible until the update is deployed.

