THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-76793 — The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrato

[NVD] CVE-2026-76793 — The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrato

mednvdPublished 2026-08-22

CVE-2026-76793 CVSS: None Published: 2026-08-22T06:16:16.900

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators.

Indicators of compromise

CVE-2026-76793cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-76793