CVE-2026-76793 Overview
CVE-2026-76793 is an authentication bypass vulnerability in the Firebase Authentication WordPress plugin versions prior to 1.7.1. The plugin fails to verify the email address inside a Firebase authentication token before matching it against a WordPress account. Unauthenticated attackers can craft a token containing the email of any registered user and receive a valid WordPress session. Successful exploitation permits login as any account, including administrators, granting complete control over the affected site. The weakness is categorized as Improper Authentication [CWE-287].
Critical Impact
Unauthenticated attackers can assume the identity of any WordPress user, including administrators, without possessing valid credentials.
Affected Products
- Firebase Authentication WordPress plugin versions before 1.7.1
- WordPress sites using the plugin for federated login
- Any user account managed through the plugin, including administrators
Discovery Timeline
- 2026-08-22 - CVE-2026-76793 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-76793
Vulnerability Analysis
The Firebase Authentication plugin exchanges a Firebase ID token for a WordPress session. During this exchange, the plugin extracts the email claim from the token and looks up the matching WordPress account. The plugin issues a session cookie for that account without checking whether the email claim has been verified by Firebase. An attacker who can obtain any Firebase-signed token containing an arbitrary email claim can therefore authenticate as the corresponding WordPress user.
Firebase permits account creation with unverified email addresses across many providers. This design assumption places the responsibility for verification on the relying application. The plugin does not enforce that responsibility, which collapses the trust boundary between token possession and account ownership.
Root Cause
The root cause is missing validation of the email_verified claim within the Firebase ID token before mapping the token to a WordPress user. The plugin treats presence of an email string as proof of ownership, violating the Improper Authentication pattern described in [CWE-287].
Attack Vector
The attack is remote and requires no authentication or user interaction. An attacker registers a Firebase account with the target administrator's email address using a provider that does not force verification. The attacker then submits the resulting ID token to the vulnerable WordPress endpoint. The plugin issues an administrator session, enabling plugin installation, content modification, and full site takeover.
Refer to the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-76793
Indicators of Compromise
- Successful WordPress logins for privileged users originating from unfamiliar IP addresses or geographies.
- New administrator accounts, plugin installations, or theme modifications appearing shortly after a Firebase authentication event.
- WordPress wp_users or wp_usermeta changes that do not correlate with a legitimate password reset or account creation flow.
Detection Strategies
- Review WordPress authentication logs for sessions established via the Firebase plugin without a corresponding verified email event on the Firebase side.
- Correlate Firebase Authentication provider logs against WordPress session creation to identify tokens minted for unverified email addresses.
- Alert on privilege changes, wp-admin access, and file writes performed by accounts that authenticated through the plugin.
Monitoring Recommendations
- Enable verbose logging on the Firebase Authentication plugin and forward events to a centralized log platform for retention and correlation.
- Monitor outbound admin actions such as plugin uploads and user role changes for a 30-day lookback following patch deployment.
- Track failed and successful login rates per source IP to identify token replay or automated abuse.
How to Mitigate CVE-2026-76793
Immediate Actions Required
- Update the Firebase Authentication WordPress plugin to version 1.7.1 or later on all affected sites.
- Force a password reset and session invalidation for all administrator and privileged accounts.
- Audit user accounts, installed plugins, and theme files for unauthorized changes introduced during the exposure window.
Patch Information
The vendor addressed the issue in Firebase Authentication plugin version 1.7.1. The fix enforces validation of the email_verified claim before mapping a Firebase token to a WordPress account. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the Firebase Authentication plugin until the site can be upgraded to version 1.7.1.
- Restrict /wp-admin and the plugin's authentication endpoints to trusted IP ranges at the web server or WAF layer.
- Configure Firebase to only allow identity providers that enforce email verification, such as email-link sign-in with mandatory confirmation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
