Vulnerabilities / EazyDocs / WPSEC-2026-0145
EazyDocs <= 2.14.0 - Login Cross-Site Request Forgery via Google Login Callback
Medium 4.3
CWE-352Fixed in 2.14.1
- ID
- WPSEC-2026-0145
- Plugin
- EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder (eazydocs)
- Affected
- from 2.7.0 before 2.14.1
- Remediation
- Update to 2.14.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- EazyDocs on WPSec AttackSurface
- Fix released
- Published
Description
The EazyDocs plugin for WordPress is vulnerable to Login Cross-Site Request Forgery in the Google Login OAuth callback in versions 2.7.0 to 2.14.0. This is due to the callback exchanging the authorization code and logging the user in before validating the OAuth state parameter, and skipping that validation entirely when the state parameter is absent. This makes it possible for unauthenticated attackers to log a victim into an attacker-controlled account by tricking them into opening a crafted callback link carrying the attacker's authorization code, when Google Login is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0145/
- https://plugins.svn.wordpress.org/eazydocs/tags/2.14.1/
- https://wordpress.org/plugins/eazydocs/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS