What is the CVSS score of CVE-2026-28185?

CVE-2026-28185 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Log in with Google are affected by CVE-2026-28185?

The rtCamp 'Log in with Google' WordPress plugin (versions ≤1.4.2) contains a critical authentication bypass allowing unauthenticated attackers to assume the identity of any legitimate user without…

How to fix or mitigate CVE-2026-28185?

Within 24 hours: Audit all WordPress instances to identify installations running rtCamp 'Log in with Google' plugin version 1.4.2 or below; prioritize inventory by user count and data sensitivity; establish incident communication protocol for affected stakeholders. Within 7 days: Immediately disable the plugin on all affected sites; implement alternative OAuth provider or revert to native WordPress authentication; conduct forensic review of access logs covering the past 30-90 days to identify unauthorized logins. Within 30 days: Enforce multi-factor authentication (2FA) across all WordPress installations as defense-in-depth; monitor Patchstack and WordPress plugin repository for vendor patch release; deploy updated plugin to production after testing in staging; implement Web Application Firewall rules to detect suspicious authentication patterns; document incident response findings and update authentication policies.

Log in with Google CVE-2026-28185

EUVD-2026-57963 CRITICAL

Insufficient Verification of Data Authenticity (CWE-345)

2026-08-13 Patchstack

GHSA-f3m5-j625-hff8

WordPress Information Disclosure Google Wordpress Plugin Log In With Google Rtcamp

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote auth bypass (PR:N/AV:N/AC:L/UI:N) yielding full account/admin takeover justifies high C/I/A; scope unchanged as impact stays within the WordPress app.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:51 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.

AnalysisAI

Authentication bypass in the rtCamp "Log in with Google" WordPress plugin (versions <= 1.4.2) lets unauthenticated remote attackers assume the identity of legitimate users because the plugin insufficiently verifies the authenticity of the Google OAuth login response. Rated CVSS 9.8, the flaw permits full account takeover without credentials or user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Patchstack advisory confirms the vulnerability class.

Technical ContextAI

The plugin implements "Sign in with Google" single sign-on for WordPress, exchanging a Google OAuth/OpenID Connect token for a local WordPress session. The root cause maps to CWE-345 (Insufficient Verification of Data Authenticity): the plugin does not adequately validate the authenticity/integrity of the identity assertion returned during the OAuth flow (for example the ID token signature, issuer/audience claims, nonce, or the binding of the returned email to a verified account). The affected component is identified by CPE cpe:2.3:a:rtcamp:log_in_with_google:*, i.e. all builds up to and including 1.4.2. Because trust is placed in attacker-influenceable authentication data rather than a cryptographically verified assertion, an attacker can forge or replay login data to be authenticated as an arbitrary user.

RemediationAI

No vendor-released patch version is identified in the provided data (only that versions <= 1.4.2 are affected), so upgrade to the next release above 1.4.2 once published by rtCamp and confirmed via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/login-with-google/vulnerability/wordpress-log-in-with-google-plugin-1-4-2-broken-authentication-vulnerability?_s_id=cve. As interim compensating controls, disable or deactivate the "Log in with Google" plugin and fall back to standard WordPress authentication (side effect: users lose Google SSO convenience), or restrict access to the plugin's OAuth callback/login endpoints via WAF or web-server rules and enforce a virtual-patch through Patchstack (side effect: possible false positives on legitimate SSO logins). Additionally audit existing user accounts and administrator sessions for unauthorized access and rotate privileged credentials, since successful exploitation would leave no failed-login trail.