Security Alert Summary
The Form Notify plugin for WordPress (up to and including version 1.1.10) contains an authentication bypass vulnerability (CVE-2026-5229). The plugin can trust a user-controlled cookie to identify which WordPress account to authenticate after a LINE OAuth login when LINE does not provide an email address. An attacker can complete a LINE OAuth flow with their own LINE account while supplying a crafted cookie containing a target user’s email to gain access to that user account, including administrator accounts.
CVE Details
- CVE ID: CVE-2026-5229
- Affected component: Form Notify plugin for WordPress
- Affected versions: versions up to and including 1.1.10
- Published: May 15, 2026 9:16:16 AM
- Last modified: May 15, 2026 2:09:15 PM
- Vulnerability status: Deferred
- CVSS v3.1: Base score 9.8, Severity: CRITICAL, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Authentication / privileges / user interaction:
- Privileges Required: NONE
- User Interaction: NONE
- Attack Vector: NETWORK
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- Weakness (CWE): CWE-287
Technical Details
This vulnerability arises because the plugin relies on user-controlled cookie data to determine which WordPress account to authenticate after a LINE OAuth login when LINE does not supply an email address. Specifically, the plugin reads the form_notify_line_email cookie value without verifying that the LINE account used for authentication is actually associated with that email address.
Because the cookie value is not tied to the LINE account or otherwise validated, an unauthenticated attacker can complete a LINE OAuth flow using their own LINE account and set a crafted form_notify_line_email cookie containing a target user’s email address. The plugin can then map that email to a WordPress account and complete authentication as the target user, potentially including administrator accounts.
The impact is direct account takeover of any mapped WordPress user without requiring credentials or user interaction beyond completing an OAuth flow. The issue is a missing validation step that verifies ownership or association between the LINE account and the email value read from the cookie.
How This Could Impact Your Website
Consider a small organization that uses Form Notify for LINE-based logins. The site owner manages content and administrators, internal staff have editor accounts, and external contractors or contributors have lower-privilege accounts. An attacker who can manipulate cookies and perform a LINE OAuth flow could authenticate as a specific internal staff member or, in some cases, an administrator by supplying that person’s email in the form_notify_line_email cookie.
Practical consequences include unauthorized access to dashboard functionality, viewing or editing private content, and exposure of internal data. Account takeovers can also reveal internal email addresses and other user details, increasing the risk of targeted phishing or social engineering against staff or contractors. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and privileges, especially for contributor and editor accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and audit any plugins that handle third-party authentication.
- Monitor site activity and logs for unusual behavior, unexpected logins, or new administrator accounts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/oberonlai/form-notify/commit/5eab0ea
- https://github.com/oberonlai/form-notify/commit/9780764
- https://plugins.trac.wordpress.org/browser/form-notify/tags/1.1.08/src/APIs/Line/Login/Route.php#L116-L118
- https://plugins.trac.wordpress.org/browser/form-notify/tags/1.1.08/src/APIs/Line/Login/User.php#L53
- https://plugins.trac.wordpress.org/browser/form-notify/tags/1.1.08/src/APIs/Line/Login/User.php#L72
- https://plugins.trac.wordpress.org/browser/form-notify/trunk/src/APIs/Line/Login/Route.php#L116-L118
- https://plugins.trac.wordpress.org/browser/form-notify/trunk/src/APIs/Line/Login/User.php#L53
- https://plugins.trac.wordpress.org/browser/form-notify/trunk/src/APIs/Line/Login/User.php#L72
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3517908%40form-notify&new=3517908%40form-notify&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2f0a7d6f-9b95-4052-bab3-85aca01f6ab7?source=cve
