Executive brief
The Firebase Authentication WordPress plugin allows attackers to log in as any user, including administrators, without knowing their password. The plugin fails to verify that an email address in a login token actually belongs to the person attempting to log in. An attacker can register a Firebase account with a victim's email address and use it to hijack their WordPress account, leading to full administrative access and potential site compromise.
Technical details
The Firebase Authentication WordPress plugin before version 1.7.1 contains an authentication bypass vulnerability (CWE-287) in how it validates Firebase ID tokens. The plugin matches WordPress user accounts based solely on the email claim in a Firebase authentication token without verifying that Firebase has confirmed the email address belongs to the token owner. An unauthenticated attacker can register a Firebase account with a victim's email address (which Firebase does not validate), obtain a signed ID token with that unverified email, and present it to the WordPress site to receive a valid session as the target user. The attack requires network access to the WordPress login endpoint, knowledge of the site's Firebase Web API key, and that the target email has no existing Firebase account. The vulnerability affects plugin versions before 1.7.1 and is fixed in that version and later.
Affected products
- WordPress Firebase Authentication before 1.7.1
Timeline
- 2026-08-20: disclosed
- 2026-08-22: patched: Fixed in version 1.7.1