Horizon Alert
Summary of the vulnerability and why it matters
The Form Notify plugin for WordPress has a critical vulnerability that allows unauthenticated attackers to bypass login procedures. This issue arises from how the plugin handles user data during LINE OAuth logins, potentially letting attackers impersonate any user on the site.
- Attackers can gain admin access.
- Any website using this plugin is at risk.
- This allows full account takeover.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can compromise any WordPress account by exploiting how the Form Notify plugin handles LINE OAuth logins when an email is missing. By initiating a LINE login and injecting a malicious cookie with a target user's email, the attacker can impersonate that user, including gaining administrator privileges.
- Target WordPress sites with plugin.
- Abuse LINE OAuth fallback.
- Inject victim's email cookie.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthenticated attackers to bypass authentication and gain access to any user account, including administrators, by exploiting how the Form Notify plugin handles LINE OAuth logins. Attackers can inject a malicious cookie to impersonate a target user, especially when LINE does not provide an email address, which is a common scenario.
- No evidence of active exploitation.
- No public exploit available.
- Vulnerability affects authentication.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate patching of the Form Notify WordPress plugin to version 1.1.11 or later to address the authentication bypass vulnerability. If patching is not immediately feasible, isolate affected WordPress instances from public access or disable the LINE OAuth login functionality within the plugin until mitigation can be applied. Continuous monitoring for unauthorized account access or suspicious activity is crucial.
- Update Form Notify plugin to 1.1.11.
- Disable LINE OAuth or isolate services.
- Monitor for account takeovers.
