# Log in with Google <= 1.4.4 - Unauthenticated Login Cross-Site Request Forgery via OAuth and One Tap State Validation

- **ID:** WPSEC-2026-2707
- **Plugin:** Log in with Google (`login-with-google`), https://wordpress.org/plugins/login-with-google/
- **Affected versions:** all versions before 1.4.5
- **Fixed in:** 1.4.5 (Update to 1.4.5 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/login-with-google
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2707/

## Description

The Log in with Google plugin for WordPress is vulnerable to Cross-Site Request Forgery via the OAuth callback and the One Tap 'validate_id_token' AJAX action in all versions up to, and including, 1.4.4, due to missing binding of the login state to the visitor's browser. The OAuth callback relied only on a WordPress nonce, which is the same for every logged-out visitor, and the One Tap token handler did not validate the state at all. This makes it possible for unauthenticated attackers to log a victim into the attacker's own account by tricking them into following a crafted link or visiting a malicious page. Anything the victim then enters on the site is saved to the attacker's account.

## References

- https://wpsec.com/vuln/WPSEC-2026-2707/
- https://plugins.svn.wordpress.org/login-with-google/tags/1.4.5/
- https://wordpress.org/plugins/login-with-google/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2707/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.