WordPress Form Notify Plugin Auth Bypass via LINE OAuth Cookie Manipulation

Executive Summary

A critical authentication bypass vulnerability (CVE-2026-5229) affects the Form Notify plugin for WordPress in versions up to and including 1.1.10. The vulnerability allows an unauthenticated attacker to log in as any WordPress user, including site administrators, by manipulating user-controlled cookie data during the LINE OAuth authentication flow.

The root cause is the plugin's unconditional trust in session cookie data to resolve the WordPress account to authenticate — without verifying that the cookie-specified account matches the identity confirmed by the LINE OAuth provider. This carries a CVSS score of 9.8 (Critical) and requires no special privileges or account on the target site to exploit.

Sites using Form Notify with LINE OAuth enabled should update to version 1.1.11 or later immediately or disable the LINE login integration until patched.

Vulnerability Overview

Affected Versions

Technical Analysis

Root Cause

The Form Notify plugin supports LINE OAuth as a social login method for WordPress sites. After a user completes the OAuth flow, LINE returns the authenticated user's identity. However, when LINE does not return an email address (which can occur based on LINE's API scope settings), the plugin falls back to reading the WordPress account identity from a user-controlled cookie.

The plugin then authenticates the request for whichever WordPress account is named in that cookie — without verifying that account has any relationship to the LINE identity that was actually authenticated. An attacker can:

1. Initiate a LINE OAuth flow to obtain a valid OAuth session
2. Before or during callback processing, set the session cookie to reference any WordPress user account (e.g., the administrator)
3. The plugin completes authentication for the cookie-specified account

This is a classic assumed-immutable data vulnerability: the plugin treats cookie data as authoritative identity even though cookies are fully attacker-controlled.

Attack Flow

1. Attacker identifies a WordPress site running Form Notify <= 1.1.10 with LINE login enabled
2. Attacker creates a LINE account (free, instant)
3. Attacker initiates the LINE OAuth flow on the target site
4. Before completing OAuth callback, attacker sets session cookie:
   e.g., form_notify_auth_user = admin (or user ID of administrator)
5. Attacker completes OAuth flow with their own valid LINE token
6. Plugin validates LINE token (passes — it's a valid token for attacker's LINE account)
7. LINE doesn't return email → plugin reads account from cookie → returns "admin"
8. Plugin creates authenticated WordPress session for the administrator account
9. Attacker is now logged in as site administrator

Exploitation Conditions

• Form Notify plugin version 1.1.10 or earlier must be installed and active
• The LINE Social Login feature must be enabled (configured per site)
• The LINE OAuth scope must not return an email address (depends on configuration; attackers can influence this)
• No prior account on the target WordPress site is required

Impact Assessment

Immediate Remediation

Step 1: Update Form Notify to Version 1.1.11 or Later

# Via WP-CLI
wp plugin update form-notify
 
# Verify version
wp plugin get form-notify --field=version
# Expected: 1.1.11 or higher

Or update via the WordPress admin panel: Plugins > Installed Plugins > Form Notify > Update Now.

Step 2: Disable LINE Login if Update Is Delayed

1. Navigate to WordPress Admin > Form Notify > Settings
2. Locate the LINE Login / Social Login configuration
3. Disable or remove LINE OAuth credentials
4. Save settings

This removes the exploitable code path until the plugin can be updated.

Step 3: Audit for Compromise

# Check for recently created administrator accounts
wp user list --role=administrator --fields=user_login,user_email,user_registered --format=table
 
# Look for suspicious recent logins (requires audit plugin or server logs)
wp db query "SELECT user_login, user_email, user_registered FROM wp_users
  WHERE user_registered > DATE_SUB(NOW(), INTERVAL 30 DAY)
  ORDER BY user_registered DESC;"
 
# Check for recently modified or unusual plugins
wp plugin list --status=active --format=table
 
# Search for recently modified PHP files (possible backdoors)
find /var/www/html/wp-content/ -name "*.php" -newer /var/www/html/wp-login.php -type f 2>/dev/null

Step 4: Harden WordPress Post-Remediation

# Force password reset for all admin accounts
wp user list --role=administrator --format=ids | xargs -I {} wp user update {} --user_pass="$(openssl rand -base64 24)"
 
# Invalidate all active sessions
wp db query "DELETE FROM wp_usermeta WHERE meta_key = 'session_tokens';"
 
# Regenerate secret keys
wp config shuffle-salts

Detection Indicators

Post-Remediation Checklist

1. Update Form Notify to version 1.1.11 or later
2. Disable LINE login if immediate update is not possible
3. Audit administrator accounts — remove any unauthorized entries
4. Reset all admin passwords and regenerate WordPress secret keys
5. Invalidate all sessions to force full re-authentication
6. Scan for webshells in wp-content/ directory
7. Review server access logs for exploitation evidence
8. Enable two-factor authentication on all admin accounts
9. Consider a WAF (Wordfence, Sucuri) with WordPress-specific rules
10. Monitor for re-exploitation for 30 days

References

• NVD — CVE-2026-5229
• Wordfence Vulnerability Database