Log In With Google
Monthly
Authentication bypass in the rtCamp "Log in with Google" WordPress plugin (versions <= 1.4.2) lets unauthenticated remote attackers assume the identity of legitimate users because the plugin insufficiently verifies the authenticity of the Google OAuth login response. Rated CVSS 9.8, the flaw permits full account takeover without credentials or user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Patchstack advisory confirms the vulnerability class.
Authentication bypass in the rtCamp "Log in with Google" WordPress plugin (versions <= 1.4.2) lets unauthenticated remote attackers assume the identity of legitimate users because the plugin insufficiently verifies the authenticity of the Google OAuth login response. Rated CVSS 9.8, the flaw permits full account takeover without credentials or user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Patchstack advisory confirms the vulnerability class.