Junglewise Threat Intelligence

CVE-2026-5229: WordPress Form Notify authentication bypass in LINE Login

CVE-2026-5229 · Severity: critical · CVSS 9.8 · Published 2026-05-15

Executive brief

The Form Notify plugin for WordPress, which integrates LINE social login features, contains a security flaw that allows attackers to log in as any user, including administrators. By manipulating a browser cookie during the login process, an attacker can bypass authentication without knowing the victim's password. This could lead to a full site takeover, data theft, or unauthorized administrative changes.

Technical details

The Form Notify plugin for WordPress is vulnerable to authentication bypass in versions up to and including 1.1.10. The vulnerability exists because the plugin trusts the 'form_notify_line_email' cookie value when the LINE OAuth provider does not return an email address. An unauthenticated attacker can exploit this by initiating a LINE OAuth flow with their own account and injecting a malicious cookie containing a target user's email address. Because the plugin fails to verify that the LINE account is actually associated with the provided email, it authenticates the attacker as the target user. This issue was addressed in version 1.1.11 by removing the cookie fallback and binding identities to the LINE 'sub' (subject) identifier via user metadata.

Affected products

  • oberonlai Form Notify <= 1.1.10

Timeline

  • 2026-04-29: patched: Initial fix in version 1.1.10 followed by hardening in 1.1.11
  • 2026-05-15: disclosed: CVE published to NVD

References