{
 "id": "WPSEC-2026-2706",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2706/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2706/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2706/index.md",
 "title": "Log in with Google <= 1.4.4 - Unauthenticated Authentication Bypass of Two-Factor and Login Checks via One Tap Login",
 "description": "The Log in with Google plugin for WordPress is vulnerable to Authentication Bypass via the One Tap login in versions 1.2 through 1.4.4, due to the One Tap handler setting authentication cookies directly without running the 'authenticate' and 'wp_authenticate_user' filters or firing the 'wp_login' action. This makes it possible for unauthenticated attackers who have access to a user's Google account to skip the two-factor authentication, lockout and approval checks that other plugins add to WordPress logins, and log in as that user, including administrators, when One Tap login is enabled.",
 "plugin": {
  "slug": "login-with-google",
  "name": "Log in with Google",
  "full_name": "Log in with Google",
  "wordpress_org": "https://wordpress.org/plugins/login-with-google/",
  "advisories_url": "https://wpsec.com/vuln/plugin/login-with-google/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/login-with-google"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-288"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.2",
    "from_inclusive": true,
    "to": "1.4.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.2 before 1.4.5"
  ]
 },
 "introduced_in": "1.2",
 "fixed_in": "1.4.5",
 "remediation": "Update to 1.4.5 or later.",
 "fix_released": "2026-11-06T11:41:29+00:00",
 "published": "2026-11-07T11:42:17+00:00",
 "updated": "2026-11-07T11:06:28.858044+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2706/",
  "https://plugins.svn.wordpress.org/login-with-google/tags/1.4.5/",
  "https://wordpress.org/plugins/login-with-google/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/login-with-google",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-07"
 }
}