CVE-2026-5229 Details

A vulnerability allowing authentication bypass has been identified in the Form Notify plugin for WordPress, affecting versions through 1.1.10. The issue arises because the plugin relies on user-controlled cookie data to authenticate users after a LINE OAuth login. When LINE does not provide an email address, the plugin defaults to the 'form_notify_line_email' cookie value, without verifying if the LINE account is linked to that email. This flaw enables unauthenticated attackers to access any user account on the site, including admin accounts, by completing a LINE OAuth flow with their own account and injecting a cookie with the target victim's email.

Users are advised to update the Form Notify plugin to version 1.1.11, which addresses the authentication bypass issue by changing the login process to use LINE user identifiers instead of email addresses.