WordPress Form Notify Plugin: Critical Authentication Bypass (CVE-2026-5229)

A critical authentication bypass vulnerability, identified as CVE-2026-5229, has been reported in the Form Notify plugin for WordPress, affecting versions up to and including 1.1.10. According to the National Vulnerability Database, this flaw stems from the plugin’s reliance on user-controlled cookie data for authentication after a LINE OAuth login. Specifically, when LINE fails to provide an email address — a common occurrence — the plugin insecurely defaults to reading the form_notify_line_email cookie value without verifying its association with the LINE account.

This design flaw creates a dangerous avenue for unauthenticated attackers. They can exploit it by initiating a LINE OAuth flow with their own account while simultaneously injecting a malicious cookie containing a target victim’s email address. The National Vulnerability Database rates this vulnerability with a CVSS score of 9.8 (CRITICAL), highlighting the severe risk. Successful exploitation grants attackers unauthorized access to any user account on the affected WordPress site, including those with administrator privileges.

For defenders, this is a clear and present danger. The attacker’s calculus is straightforward: leverage a common OAuth fallback mechanism to achieve full account takeover with minimal effort. This isn’t theoretical; it’s a direct path to compromise for any WordPress site running the vulnerable Form Notify plugin. The implications for data integrity, confidentiality, and overall site security are profound, making immediate action imperative.