The WordPress Log in with Google plugin versions 1.4.2 and earlier allow attackers to authenticate without providing valid credentials. The vulnerability arises from a missing or improperly enforced authentication check, leading to an authentication bypass (CWE-345). An attacker can thus log in as any user, gaining full control over the site, its content, and any stored data. The description indicates the flaw is in the plugin’s login flow and does not require the user to pass through Google’s authentication mechanism.

Any WordPress installation running the rtCamp "Log in with Google" plugin at version 1.4.2 or earlier is affected. The plugin is widely distributed and used to enable Google account login for site visitors. Site owners should verify the plugin version they are using.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. No EPSS score is available, so the precise likelihood of exploitation is unknown, but the absence of authentication checks makes exploitation trivial. The plugin’s public login endpoint provides a direct remote attack vector; an attacker can craft a request to the login URL and obtain a session token for any user. The vulnerability is not currently listed in the CISA KEV catalog, though it remains a high‑risk issue for affected sites.