CVE-2026-76793

HighCVSS 8.1

Published: 22/08/2026(UTC)Updated: 12/10/2026(UTC)Translated: 22/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

39th percentile - higher than 39% of all known CVEs

Summary

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators.

Risk Assessment

The vulnerability may allow an unauthenticated attacker to fully take over an administrator account, leading to complete compromise of the WordPress site.

Recommendation

It is recommended to immediately update the plugin to version 1.7.1 or later, which contains the fix.

Other vulnerabilities in Firebase Authentication

CVE-2026-85268High
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS