Authentication Bypass in Firebase Authentication Plugin for WordPress
CVE-2026-76793

Currently unrated

Key Information:

Vendor

WordPress
Status
Firebase Authentication
Vendor
CVE Published:
22 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-76793?

The Firebase Authentication plugin for WordPress has a security vulnerability that permits unauthenticated attackers to log in as any user, including those with administrative privileges. This issue arises because the plugin fails to verify the email address in the authentication token prior to matching it with a WordPress account, thereby allowing unauthorized access and potential exploitation of user data. It is important for WordPress site owners utilizing this plugin to update to version 1.7.1 or higher to mitigate this risk.

Affected Version(s)

Firebase Authentication 0 < 1.7.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-76793 - Proof of Concept

References

https://wpscan.com/vulnerability/0414ef2b-0d97-41c7-9146-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdullah Kareem
WPScan
.