CVE-2026-76793 — Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim

CVE-2026-76793

Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim PUBLISHED

Description (CNA)

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators.

Affected (CNA)

Vendor / product	Versions
Unknown / Firebase Authentication	affected 0 before 1.7.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/0414ef2b-0d97-41c7-9146-f31ace8b66b2/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.