# Log in with Google <= 1.4.4 - Unauthenticated Authentication Bypass of Two-Factor and Login Checks via One Tap Login

- **ID:** WPSEC-2026-2706
- **Plugin:** Log in with Google (`login-with-google`), https://wordpress.org/plugins/login-with-google/
- **Affected versions:** from 1.2 before 1.4.5
- **Fixed in:** 1.4.5 (Update to 1.4.5 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-288
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/login-with-google
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2706/

## Description

The Log in with Google plugin for WordPress is vulnerable to Authentication Bypass via the One Tap login in versions 1.2 through 1.4.4, due to the One Tap handler setting authentication cookies directly without running the 'authenticate' and 'wp_authenticate_user' filters or firing the 'wp_login' action. This makes it possible for unauthenticated attackers who have access to a user's Google account to skip the two-factor authentication, lockout and approval checks that other plugins add to WordPress logins, and log in as that user, including administrators, when One Tap login is enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2706/
- https://plugins.svn.wordpress.org/login-with-google/tags/1.4.5/
- https://wordpress.org/plugins/login-with-google/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2706/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.