CVE-2026-76793 Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim
Unauthenticated attackers can log in as any user, including administrators, by exploiting unverified email matching in the Firebase Authentication plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76793?
CVE-2026-76793 is a high-severity authentication bypass vulnerability in Unknown Firebase Authentication, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators.
Weakness: CWE-287
Which versions are affected by CVE-2026-76793?
How do I fix CVE-2026-76793?
No fix has been published for CVE-2026-76793 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-76793 being exploited?
There is no known exploitation of CVE-2026-76793 in the wild and no public exploit code.
Sources
Also known as GHSA-3hq2-mp89-6vp5.