The likely attack vector is via the plugin’s authentication endpoint, inferred from the fact it accepts tokens without verification. The Firebase Authentication WordPress plugin before version 1.7.1 accepts authentication tokens without first confirming that the email claim has been verified. An attacker can therefore craft a token containing any email address and present it to the plugin, which will match the claim to a WordPress user account and issue a session cookie. The result is that the attacker can log in as any user, including administrators, without holding valid credentials, giving full control over the site and its data.

This flaw affects the Firebase Authentication WordPress plugin versions 1.0 through 1.6.x (that is, any release prior to 1.7.1). WordPress sites that have installed or activated this plugin are at risk. No other WordPress components are impacted.

Based on the description, it is inferred that the attack can be launched remotely via the plugin’s authentication endpoint. Given that the exploit requires only the creation of a well‑formed authentication token and does not rely on any additional privileges, the attack can be launched from any external network position. The lack of a public KEV listing does not diminish the inherent severity; being able to take over any account, including administrators, remains a critical threat. The CVSS base score of 8.1 indicates high severity, and the EPSS score of <1% means exploitation probability is low at present, but the impact of a successful exploit remains severe.