Brief Summary: WordPress Form Notify Plugin CVE-2026-5229 Authentication Bypass via LINE OAuth Cookie Trust

Introduction

One trusted cookie in a WordPress plugin's OAuth callback is enough for an unauthenticated attacker to log in as any user on the site, including administrators. CVE-2026-5229, scored at CVSS 9.8, is that flaw in the Form Notify plugin's LINE OAuth integration, where a client-controlled cookie decides which WordPress account gets authenticated.

Form Notify (full name: "Receive Notifications After Form Submitting – Form Notify for Any Forms") is a WordPress plugin developed by Oberon Lai that handles form submission notifications. It is small, with over 20 active installations on the WordPress plugin repository. What matters here is its integration with LINE, a messaging platform widely used in East and Southeast Asia, which it uses for OAuth-based login.

Technical Information

The root cause of CVE-2026-5229 is an unverified fallback in the plugin's LINE OAuth callback handler. When a user authenticates through LINE OAuth, the plugin needs an email address to match the LINE identity to a WordPress account. But LINE does not always provide one, which is common among users in the plugin's target demographic, where LINE accounts are often created without an email.

To handle this, the developer added a fallback: the plugin reads a cookie named form_notify_line_email from the client's browser and uses its value as the email address for account lookup. The vulnerable code in Route.php (lines 116 through 118) does this:

if ( isset ( $_COOKIE['form_notify_line_email'] ) ) {
    $line_email = sanitize_text_field( wp_unslash( $_COOKIE['form_notify_line_email'] ) );
}
$user_email = ( $user->email ) ? $user->email : $line_email;

The flaw is that the plugin applies sanitize_text_field to the cookie value (preventing XSS) but never verifies that the LINE account completing the OAuth flow is actually tied to that email address. The cookie is entirely client-controlled, so the attacker can inject any value.

The vulnerable code paths span multiple files:

• src/APIs/Line/Login/Route.php (lines 116 through 118): the cookie fallback assignment
• src/APIs/Line/Login/User.php (line 53): where the email is used for user lookup
• src/APIs/Line/Login/User.php (line 72): where the authenticated session is established

Attack Flow

Exploiting this takes no prior authentication:

1. Target identification: The attacker finds the email address of a target WordPress user. For administrators, this is often discoverable through author pages, public profiles, or common WordPress information disclosure patterns.

2. Cookie injection: The attacker sets a browser cookie named form_notify_line_email to the target's email address. This can be done through browser developer tools, a proxy, or any HTTP client.

3. OAuth flow completion: The attacker starts the LINE OAuth login on the target WordPress site using their own valid LINE account. The attacker's LINE account must not have an email bound (or LINE must not return one), which triggers the fallback path.

4. Account takeover: The plugin reads the attacker's injected cookie, resolves it to the victim's WordPress account, and authenticates the attacker as that user. If the target email belongs to an administrator, the attacker now has full administrative access to the site.

The whole attack needs only two things: the target's email address and a valid LINE account. No special tooling or elevated privileges.

Why This Pattern Is Dangerous

This is a textbook case of why client-controlled data should never drive authentication decisions. The cookie was added as a convenience for users whose LINE accounts have no email, but it created a direct path from an unauthenticated request to arbitrary account access. The sanitize_text_field call sanitizes input but does not verify identity, and those are different security concerns.

Affected Systems and Versions

The vulnerability affects the following:

• Plugin: Receive Notifications After Form Submitting – Form Notify for Any Forms
• Affected versions: all versions up to and including 1.1.10
• Vulnerable configuration: any WordPress site with the Form Notify plugin installed and LINE OAuth login enabled
• Fixed version: 1.1.11 (security hardening with LINE sub-based identity binding)

Version 1.1.10 removed the cookie fallback but still used email-based identity binding. Update to 1.1.11, which shifts identity binding to the verified LINE sub identifier stored in WordPress user meta.

References

• Wordfence Threat Intelligence Advisory
• NVD Entry for CVE-2026-5229
• GitHub Commit 5eab0ea: Remove cookie fallback
• GitHub Commit 9780764: Comprehensive security hardening (1.1.11)
• Vulnerable Route.php (tag 1.1.08)
• Vulnerable User.php line 53 (tag 1.1.08)
• Vulnerable User.php line 72 (tag 1.1.08)
• Trunk Route.php
• Trunk User.php line 53
• Trunk User.php line 72
• WordPress Plugin Changeset
• Form Notify WordPress Plugin Page
• Developer Blog Post on LINE Login Email Handling