Log in with Google <= 1.4.4 - Unauthenticated Login Cross-Site Request Forgery via OAuth and One Tap State Validation
- ID
- WPSEC-2026-2707
- Plugin
- Log in with Google (login-with-google)
- Affected
- all versions before 1.4.5
- Remediation
- Update to 1.4.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-07
- Attack surface
- Log in with Google on WPSec AttackSurface
- Fix released
- Published
Description
The Log in with Google plugin for WordPress is vulnerable to Cross-Site Request Forgery via the OAuth callback and the One Tap 'validate_id_token' AJAX action in all versions up to, and including, 1.4.4, due to missing binding of the login state to the visitor's browser. The OAuth callback relied only on a WordPress nonce, which is the same for every logged-out visitor, and the One Tap token handler did not validate the state at all. This makes it possible for unauthenticated attackers to log a victim into the attacker's own account by tricking them into following a crafted link or visiting a malicious page. Anything the victim then enters on the site is saved to the attacker's account.
References
- https://wpsec.com/vuln/WPSEC-2026-2707/
- https://plugins.svn.wordpress.org/login-with-google/tags/1.4.5/
- https://wordpress.org/plugins/login-with-google/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS