CVE-2026-5229 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-5229 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-5229 is a critical authentication bypass in the Form Notify WordPress plugin, affecting versions up to and including 1.1.10. The flaw lets an attacker log in as another user by abusing a LINE OAuth flow and injecting a malicious cookie value that the plugin trusts without verification. If your site uses this plugin for login or account linking, treat this as a full account takeover risk, including administrator accounts.

No active exploitation is known at this time and it is not in CISA KEV, but the severity is CVSS 9.8, so small teams should act immediately. If you cannot patch right away, disable the plugin or remove the LINE login path until you can confirm a fixed release.

Immediate Action

  • Update Form Notify immediately to the first fixed version, if available. If no fixed version is published yet, disable the plugin now and remove it from public login flows. See the vendor advisory for the latest patched release.
  • Block or bypass LINE OAuth login at the application layer until patched. If needed, temporarily switch to local WordPress login only.
  • Invalidate active sessions for all users, especially administrators, after patching or disabling the plugin.
  • Audit admin accounts for unexpected logins, new users, role changes, and profile/email changes.
  • Roll back only if necessary: if a newer release breaks production, roll back to a known-safe version that does not include the vulnerable plugin path, or isolate the site behind maintenance mode while you test.
  • Restrict access to wp-admin and login endpoints from trusted IPs if your workflow allows it.

Affected Versions

  • form-notify <= 1.1.10 vulnerable
  • form-notify 1.1.11+ safe (TODO: confirm fixed version from vendor advisory)

Resolution Guide

WordPress / plugin update:

# If you manage plugins via WP-CLI
wp plugin update form-notify

# If you need to pin a known-safe version after vendor confirmation
wp plugin install form-notify --force --version=TODO_FIXED_VERSION

Composer-managed WordPress installs:

composer update vendor/form-notify --with-all-dependencies
# or pin a safe version once confirmed
composer require vendor/form-notify:^TODO_FIXED_VERSION

npm / yarn / pnpm are not typical for WordPress plugins, but if your build pipeline packages the plugin assets, update the package that ships the plugin bundle:

npm update
yarn upgrade
pnpm update

Python / Java / system package managers are generally not applicable to this plugin, but if you mirror the plugin in an internal package or container, update the image or package source:

# apt/yum examples for image or host hardening
sudo apt update
sudo apt install --only-upgrade TODO_PACKAGE_NAME

sudo yum update TODO_PACKAGE_NAME

Docker: rebuild using a tag that includes the fixed plugin version or remove the plugin from the image entirely.

docker build --no-cache -t yoursite:patched .
docker run -d --name yoursite yoursite:patched

Hardening / temporary mitigation:

# Disable the plugin if you cannot patch immediately
wp plugin deactivate form-notify

# If you must keep the site up, block the LINE login route at the web server
# Example placeholder: deny access to the OAuth callback endpoint
# location /TODO_LINE_OAUTH_CALLBACK { deny all; }

Minimal code fix concept: the plugin must not trust a user-controlled cookie to select the authenticated account. It should only authenticate when the LINE identity is verified against a server-side mapping.

// Pseudocode: do not use cookie email as the source of truth
$line_user = verify_line_oauth_token($token);
$linked_account = find_wp_user_by_verified_line_id($line_user['sub']);

if (!$linked_account) {
    return new WP_Error('auth_failed', 'No verified account link found');
}

// Never fall back to form_notify_line_email cookie
wp_set_current_user($linked_account->ID);
wp_set_auth_cookie($linked_account->ID);

Detection & Verification

Check the installed version:

wp plugin list | grep -i form-notify
# or inspect the plugin header directly
grep -R "Version:" wp-content/plugins/form-notify/ -n

Look for the risky cookie and LINE login flow:

grep -R "form_notify_line_email\|LINE OAuth\|oauth" wp-content/plugins/form-notify/ -n

Check for suspicious admin access:

# WordPress logs vary by setup; inspect web logs for login/callback activity
grep -iE "wp-login.php|oauth|line" /var/log/nginx/access.log /var/log/apache2/access.log

Verify the fix:

# Confirm the plugin version is above the vulnerable range
wp plugin list | grep -i form-notify

# Confirm the vulnerable cookie is no longer used in auth decisions
grep -R "form_notify_line_email" wp-content/plugins/form-notify/ -n || echo "No cookie-based auth fallback found"

# If you have a staging site, test that a forged cookie no longer changes the authenticated account

Risk and Impact

This bug can let an unauthenticated attacker become any user on the site by completing a LINE OAuth flow with their own account and supplying a victim’s email in a cookie. Because the plugin falls back to user-controlled cookie data when LINE does not return an email, the attacker can bypass authentication entirely and potentially reach administrator privileges.

For solo developers and small teams, the blast radius is high: site defacement, data theft, plugin/theme changes, malicious admin creation, and persistent compromise. If the plugin is exposed on a public site, assume the login path is unsafe until you patch or disable it.

Keep reading