Vulnerabilities / EazyDocs / WPSEC-2026-0144
EazyDocs <= 2.14.0 - Unauthenticated Authentication Bypass via Google Login
High 8.1
CWE-287Fixed in 2.14.1
- ID
- WPSEC-2026-0144
- Plugin
- EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder (eazydocs)
- Affected
- from 2.7.0 before 2.14.1
- Remediation
- Update to 2.14.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- EazyDocs on WPSec AttackSurface
- Fix released
- Published
Description
The EazyDocs plugin for WordPress is vulnerable to Authentication Bypass via the Google Login feature in versions 2.7.0 to 2.14.0. This is due to the plugin looking up the WordPress user by the email address returned by Google's userinfo endpoint without checking whether Google had verified that address. This makes it possible for unauthenticated attackers who hold a Google account carrying a victim's unverified email address to log in as the matching WordPress user, including administrators, when Google Login is enabled and configured.
References
- https://wpsec.com/vuln/WPSEC-2026-0144/
- https://plugins.svn.wordpress.org/eazydocs/tags/2.14.1/
- https://wordpress.org/plugins/eazydocs/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS