Authentication Bypass Vulnerability in Form Notify Plugin for WordPress

CVE-2026-5229

What is CVE-2026-5229?

The Form Notify plugin for WordPress is susceptible to an authentication bypass vulnerability that affects versions up to 1.1.10. This flaw arises from the plugin's reliance on user-controlled cookie data to authenticate accounts post-LINE OAuth login. Particularly, when LINE fails to return an email address, the plugin falls back on the 'form_notify_line_email' cookie without confirming any association between the provided email and the LINE account. This reliance enables attackers to exploit this weakness, gaining unauthorized access to user accounts, including those with administrative privileges, by completing the LINE OAuth process while injecting a malicious cookie containing a targeted victim's email address.

References