Firebase Authentication CVE-2026-76793

Exploitation requires that the target WordPress site has the Firebase Authentication plugin installed and active in a version prior to 1.7.1, and that at least one WordPress user account has an email address the attacker can discover or enumerate (via public author pages, WHOIS, contact forms, or directory brute-forcing). The attacker must be able to register a Firebase account using the target email without completing verification - this is Firebase's default behavior unless the site owner has enforced server-side email verification at the Firebase project level. The CVSS PR:N vector confirms no WordPress credentials are required. Exploitation is constrained by AC:H: if the target email is already registered and verified on Firebase under a different owner, duplicate registration may be blocked, requiring the attacker to use an alternative Firebase project or approach. Limiting factors include the attacker's ability to discover valid WordPress account email addresses and the AC:H setup requirement; there is no special WordPress server configuration required beyond the plugin being active.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) scores 8.1 (High), reflecting network-reachable unauthenticated exploitation with full CIA impact, tempered by AC:H - the attacker must successfully obtain or mint a Firebase JWT containing the target user's email without prior verification, which requires some setup (e.g., registering on Firebase before the target does, or using a separate Firebase project). EPSS at 0.20% (11th percentile) is notably low relative to the CVSS score, suggesting automated mass exploitation is not currently occurring; this is consistent with the AC:H complexity. There is no CISA KEV listing and no identified POC at time of analysis. Despite the low EPSS, the real-world priority remains elevated: a single successful exploit yields full administrator access to the WordPress instance, enabling arbitrary content modification, plugin installation, credential harvesting, and lateral pivot. Sites with administrators whose email addresses are publicly discoverable carry the highest practical risk. The AC:H factor provides meaningful but not robust protection - it reflects setup complexity, not a strong cryptographic barrier.

An attacker enumerates a WordPress administrator's email address from a public profile or contact page, then registers a new Firebase account using that email address without completing email verification, obtaining a valid Firebase JWT. The attacker submits this token to the WordPress site's Firebase auth callback endpoint; the unpatched plugin extracts the email claim, locates the matching WordPress admin account, and issues a fully authenticated WordPress session - granting the attacker unrestricted administrative access to the site.