High severity8.1NVD Advisory· Published Aug 22, 2026· Updated Aug 26, 2026
CVE-2026-76793
CVE-2026-76793
Description
The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <1.7.1
Patches
Vulnerability mechanics
References
1News mentions
2- Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)Wordfence Blog · Aug 27, 2026
- WordPress Plugins: 25 Vulnerabilities Disclosed, Including Critical Auth Bypass and Code Execution FlawsVypr Intelligence · Aug 23, 2026