CVE-2026-28185
Received Received - Intake

BaseFortify

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Patchstack

Description
Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-28185
EUVD
EUVD-2026-57963

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
patchstack log_in_with_google to 1.4.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-28185 is an unauthenticated broken authentication vulnerability in the WordPress Log in with Google plugin versions 1.4.2 and earlier. It allows attackers to perform actions restricted to higher-privileged users without authentication, potentially gaining admin access to the site.

Detection Guidance

Check if the Log in with Google plugin version is 1.4.2 or earlier. Use WordPress admin panel to inspect plugin versions or run a site scan with security tools like Patchstack or Wordfence.

Impact Analysis

This vulnerability can allow attackers to take over your WordPress site by gaining admin access, leading to complete control over the website, data theft, or further attacks on visitors. The high CVSS score of 9.8 indicates it is highly likely to be exploited in mass campaigns.

Mitigation Strategies

Update the Log in with Google plugin to version 1.4.3 immediately. Apply Patchstack's mitigation rule if an update is not possible right away.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28185. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart