PT-2026-41273 · WordPress · Form Notify

Nabil Irawan · Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-5229

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Form Notify versions prior to 1.1.11

Description The Form Notify plugin for WordPress allows authentication bypass because it trusts user-controlled cookie data to determine the WordPress account to authenticate following a LINE OAuth login. If LINE does not provide an email address, the plugin uses the value of the form notify line email cookie without verifying the association between the LINE account and that email. This allows unauthenticated attackers to gain access to any user account, including administrator accounts, by completing a LINE OAuth flow with their own account while injecting a cookie containing the target victim's email address.

Recommendations Update the plugin to a version later than 1.1.10.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-5229

Affected Products

Form Notify

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5229.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-5229 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5229 · Security Note
• https://t.me/cveNotify/163588 · Telegram Post
• https://github.com/oberonlai/form-notify/commit/5eab0ea · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3517908%40form-notify&new=3517908%40form-notify&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/form-notify/trunk/src/APIs/Line/Login/Route.php#L116-L118 · Note
• https://twitter.com/UpwindMDR/status/2055261867631591548 · Twitter Post
• https://t.me/CVEtracker/53893 · Telegram Post
• https://plugins.trac.wordpress.org/browser/form-notify/trunk/src/APIs/Line/Login/User.php#L53 · Note
• https://github.com/oberonlai/form-notify/commit/9780764 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2f0a7d6f-9b95-4052-bab3-85aca01f6ab7?source=cve · Note
• https://plugins.trac.wordpress.org/browser/form-notify/trunk/src/APIs/Line/Login/User.php#L72 · Note
• https://twitter.com/OrizonCyber/status/2055226717308887266 · Twitter Post
• https://plugins.trac.wordpress.org/browser/form-notify/tags/1.1.08/src/APIs/Line/Login/User.php#L72 · Note