Description

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-22T06:16:17.150Z",
  "pubdate": "2026-08-22T06:16:17.150Z",
  "executiveSummary": "The WP Social Media Login WordPress plugin through version 1.0.6 suffers from a critical authentication bypass vulnerability stemming from insufficient verification of social login assertions. The flaw resides in the authentication logic, which fails to cryptographically or cryptographically-equivalently validate that the authentication flow was successfully completed with the designated identity provider prior to granting session access.\nAn unauthenticated, remote attacker can leverage this weakness to achieve arbitrary user impersonation. By supplying a target user's email address within the login request parameters, an adversary can successfully authenticate and establish an active session as that user. The impact of this vulnerability is critical, as successful exploitation enables attackers to log in as any existing registered account on the target WordPress instance, including high-privileged users and administrators, leading to complete system compromise.\nThe attack requires network connectivity to the vulnerable WordPress site and knowledge of or the ability to enumerate a valid target user's email address. No prior authentication, user interaction, or specific privileges are required to execute the exploit. The risk implication is severe due to the potential for full administrative takeover without leaving standard audit trails associated with credential theft.",
  "technicalDetails": "The root cause of the vulnerability is an implementation flaw in the authentication validation workflow within the WP Social Media Login WordPress plugin through version 1.0.6. Specifically, the vulnerable component fails to properly verify the cryptographic tokens, callback assertions, or authorization codes returned by the third-party identity provider during the OAuth or social authentication handshake.\nInstead of validating the session state and ensuring the callback originates from a legitimate, completed authentication sequence with the provider, the plugin relies on client-supplied identifiers—specifically the target user's email address—to determine session establishment. This missing input validation and broken authentication logic allow unauthenticated adversaries to forge or spoof authentication requests.\nThe attack flow proceeds as follows: 1) The unauthenticated attacker identifies the email address of a target user, such as an administrator, on the vulnerable WordPress site. 2) The attacker crafts an HTTP request targeting the plugin's social login handling endpoint. 3) Rather than initiating an actual OAuth redirect flow with an external identity provider, the attacker injects the target victim's email address directly into the authentication handler parameters. 4) Due to the absence of verification checks confirming whether the social login was actually completed with the identity provider, the plugin blindly trusts the supplied email address. 5) The backend application queries the WordPress database for a user matching the provided email, locates the account, and programmatically instantiates an authenticated session via functions such as wp_set_current_user() and wp_set_auth_cookie().\nPost-exploitation impact grants the attacker the exact privilege level associated with the targeted email address. If the targeted account holds administrator privileges, the attacker gains full administrative control over the WordPress installation, enabling arbitrary file upload, plugin installation, database manipulation, and potential remote code execution on the underlying server infrastructure."
}