CVE-2026-76793: Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim

Q: Which accounts are at risk?

Any WordPress account that can be matched by email is at risk, including administrator accounts. The vulnerable plugin can issue a WordPress session based on an unverified email address in an authentication token.

Q: What does an attacker need to exploit this issue?

The issue is described as unauthenticated. An attacker needs to present an authentication token containing an email address that matches the target WordPress account, without that email address needing to be verified.

Q: Which plugin versions are affected?

Firebase Authentication WordPress plugin versions before 1.7.1 are affected. Version 1.7.1 is identified as the version at or above which this email-verification requirement is addressed.

Published Aug 22, 2026

Updated

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators.

Affected Software

1 affected component

Firebase WordPress plugin<1.7.1

Event History

Aug 22, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which accounts are at risk?

Any WordPress account that can be matched by email is at risk, including administrator accounts. The vulnerable plugin can issue a WordPress session based on an unverified email address in an authentication token.

What does an attacker need to exploit this issue?

The issue is described as unauthenticated. An attacker needs to present an authentication token containing an email address that matches the target WordPress account, without that email address needing to be verified.

Which plugin versions are affected?

Firebase Authentication WordPress plugin versions before 1.7.1 are affected. Version 1.7.1 is identified as the version at or above which this email-verification requirement is addressed.