## Summary
CVE-2026-28185 is an unauthenticated broken authentication issue in the WordPress plugin Login with Google versions <= 1.4.2. The vulnerability is assessed as critical (CVSS 9.8) and is described as highly dangerous and expected to be exploited in mass campaigns.
## Technical Details
The NVD description and Patchstack advisory classify the issue as unauthenticated broken authentication (CWE-CWE-345). Patchstack notes that the flaw can be abused by a malicious actor to perform actions that normally require higher privileges, potentially leading to admin access.
Patchstack also states that, due to the specific nature of the vulnerability, “all legitimate and illegitimate requests are blocked to cover all scenarios,” and that a mitigation rule can block attacks until the plugin is updated.
## Affected
- WordPress plugin Login with Google versions <= 1.4.2
## Impact
- Unauthenticated attacker can abuse broken authentication to execute privileged actions
- Potential admin access to the website
- High likelihood of exploitation in mass-exploit campaigns (Patchstack risk note)
## Mitigation
1. Update the plugin to 1.4.3 or later to resolve the vulnerability.
2. If immediate updating is not possible, use the Patchstack mitigation rule to block attacks until patched.
3. If available in your environment, enable Patchstack auto-update for vulnerable plugins only.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-345