CVE Intelligence
Analysis AI-assisted

CVE-2026-5229: Form Notify for WordPress – Authentication Bypass via LINE OAuth Callback

Form Notify for Any Forms, a WordPress plugin, contains an authentication bypass in versions up to and including 1.1.10. Because the LINE OAuth login relies on a client-supplied cookie to choose the account, unauthenticated attackers may be able to sign in as any site user, including administrators. The record assigns CVSS 3.1 9.8 (Critical), lists no fixed version, and shows no CISA KEV listing.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Form Notify for Any Forms is a WordPress plugin. Wordfence reports an authentication bypass affecting versions up to and including 1.1.10, classified as CWE-287 (Improper Authentication). The flaw sits in the LINE OAuth login path: when LINE does not return an email address, the plugin relies on a cookie value supplied by the client to pick the WordPress account to sign in, without confirming that the LINE identity belongs to that account. See the Wordfence threat intelligence entry and the NVD entry.

Impact

  • According to the record, unauthenticated attackers may gain access to any user account on the site, including administrator accounts.
  • The CNA-reported CVSS 3.1 base score is 9.8 (Critical), with high confidentiality, integrity and availability impact.
  • Administrative access would allow changes to site content, users, plugins and stored data.

Affected products and versions

  • Product as listed: Form Notify for Any Forms (WordPress plugin), versions up to and including 1.1.10.
  • The record lists no fixed version. The advisory references the plugin source file at User.php, which is where the affected logic is located.

Exploitation status

  • CISA KEV: not listed in the record.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • SSVC exploitation is recorded as none and automatable as yes. EPSS probability is 0.01102 with percentile 0.64858, as recorded.

Remediation and mitigation

  • Check whether the Form Notify plugin is installed and which version is active. Treat version 1.1.10 and earlier as affected.
  • Update to a release newer than 1.1.10 once the plugin developer publishes one. The record does not name a fixed version.
  • If an update is not immediately possible, disable the LINE login integration or deactivate the plugin until a fix is confirmed.
  • Review administrator accounts for unexpected creation or privilege changes, and rotate credentials where compromise is suspected.

Detection guidance

  • Review authentication logs for administrator logins that occur around LINE login callback requests, especially from unfamiliar networks.
  • Look for unexpected new administrator accounts, role changes, and modifications to plugin or theme files.
  • Monitor for unusual cookies with the plugin's naming pattern set on login-related requests.

Limitations of the available information

  • The record does not state a fixed version or describe a patch.
  • Two GitHub commits are referenced and may relate to remediation, but the record does not confirm their content.
  • The product name in the record includes an unexplained identifier prefix; the affected version range is taken as written.

Frequently asked questions

Is CVE-2026-5229 being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. SSVC records exploitation as none, although it is marked automatable.

Which versions are affected and is there a fix?

Versions up to and including 1.1.10 are listed as affected. The record does not name a fixed version, so administrators should check with the plugin developer and update once a release is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.