WordPress Plugin Vulnerabilities

Log in with Google < 1.4.3 - Authentication Bypass

Description

The plugin is vulnerable to Authentication Bypass, making it possible for unauthenticated attackers to bypass authentication and access other users' accounts, including administrators.

Affects Plugins

Plugin icon
login-with-google
Fixed in 1.4.3

References

CVE
CVE-2026-28185
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/d06761dc-8f06-44ce-b2c6-4f9a0682472d

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Abdullah Kareem "cyberkareem"
Verified
No
WPVDB ID
4b169cf0-1b93-4204-b060-f6b45988434a

Timeline

Publicly Published
2026-08-13 (about 2 months ago)
Added
2026-08-20 (about 1 month ago)
Last Updated
2026-10-16 (about 10 hours ago)

Other

Published
Title
Published
2026-10-01
Title
TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN
Published
2024-05-28
Title
AppPresser < 4.4.0 - Improper Missing Encryption Exception Handling to Authentication Bypass
Published
2026-10-09
Title
Advanced IP Blocker < 8.13.14 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
Published
2019-08-12
Title
JVM WooCommerce Wishlist <= 1.2.6 - Insecure Direct Object Reference
Published
2014-08-01
Title
Editorial Calendar 2.6 - Permission Verification Arbitrary Calendar Post Deletion