The Form Notify WordPress plugin allows an unauthenticated attacker to bypass authentication by manipulating cookie data during a LINE OAuth login. When a LINE account does not provide an email address, the plugin reads the value from the form_notify_line_email cookie without verifying its association with the LINE account. By sending a malicious cookie containing the target victim’s email address and completing the LINE OAuth flow with their own LINE account, an attacker can authenticate as any user, including administrators, granting full site access.

WordPress sites that have installed the Form Notify plugin in versions 1.1.10 or earlier are affected. Any site using the plugin before the release of a fixed version is at risk, regardless of the number of users or the configuration of LINE OAuth.

The CVSS score of 9.8 indicates critical severity. EPSS data is not available, but the lack of a KEV listing does not reduce the urgency; the vulnerability enables remote unauthorized access via a web-based OAuth flow. Attackers can target any publicly accessible WordPress site that accepts LINE OAuth login from the plugin, making the exploit plausible for large-scale attacks.