Vulnerabilities / Log in with Google / WPSEC-2026-2706
Log in with Google <= 1.4.4 - Unauthenticated Authentication Bypass of Two-Factor and Login Checks via One Tap Login
High 8.1
CWE-288Fixed in 1.4.5
- ID
- WPSEC-2026-2706
- Plugin
- Log in with Google (login-with-google)
- Affected
- from 1.2 before 1.4.5
- Remediation
- Update to 1.4.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-288
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-07
- Attack surface
- Log in with Google on WPSec AttackSurface
- Fix released
- Published
Description
The Log in with Google plugin for WordPress is vulnerable to Authentication Bypass via the One Tap login in versions 1.2 through 1.4.4, due to the One Tap handler setting authentication cookies directly without running the 'authenticate' and 'wp_authenticate_user' filters or firing the 'wp_login' action. This makes it possible for unauthenticated attackers who have access to a user's Google account to skip the two-factor authentication, lockout and approval checks that other plugins add to WordPress logins, and log in as that user, including administrators, when One Tap login is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2706/
- https://plugins.svn.wordpress.org/login-with-google/tags/1.4.5/
- https://wordpress.org/plugins/login-with-google/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS