Description

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-22T06:16:17.323Z",
  "pubdate": "2026-08-22T06:16:17.323Z",
  "executiveSummary": "An authentication bypass vulnerability has been identified in the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through version 1.2.0.\nThe flaw exists due to a complete absence of authentication, authorization, and cryptographic nonce validation mechanisms within a publicly accessible login handler.\nUnauthenticated remote threat actors can exploit this security deficiency to arbitrarily generate and hijack valid user sessions for any registered account on the target WordPress installation.\nCrucially, default configurations allow attackers to acquire elevated administrative privileges, specifically impersonating the site's original administrator account without requiring prior knowledge of credentials, password hashes, or security tokens.\nThe business impact of this vulnerability is critical, as successful exploitation grants full administrative control over the underlying WordPress instance, leading to potential data exfiltration, arbitrary code execution, and complete site compromise.\nThe attack vector requires network connectivity to the targeted web application but demands zero privileges, specific user interaction, or pre-existing authentication.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation and missing access control enforcement within the login handling mechanism exposed by the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin.\nSpecifically, the affected endpoint fails to implement standard WordPress security controls, such as checking user session tokens, verifying cryptographic nonces via wp_verify_nonce(), or evaluating user capabilities through current_user_can() before processing authentication state transitions.\nBecause the login handler is publicly accessible over the network, an unauthenticated attacker can craft HTTP requests targeting this specific handler.\nThe attack flow proceeds as follows: First, the attacker identifies or probes the publicly accessible login handler endpoint provided by the plugin. Second, the attacker formulates an HTTP request designed to interface with the insecure login routine, targeting a specific username or identifier, such as the primary administrator account. Third, because the backend logic accepts the incoming request without validating authentication proofs, authorization credentials, or nonces, it processes the request as legitimate. Fourth, the application instantiates a valid PHP session or authentication cookie associated with the targeted user account. Finally, the attacker utilizes the newly established session tokens to authenticate to the WordPress dashboard, bypassing all standard login restrictions.\nThe affected component is the login handler function within the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin for versions up to and including 1.2.0.\nNo authentication or privilege requirements are needed to initiate the exploit, making it entirely trivial for external unauthenticated adversaries to execute over the network.\nPost-exploitation impact includes full administrative takeover, unauthorized modification of site content, installation of malicious plugins or themes, injection of persistent backdoors, and potential pivot attacks against underlying server infrastructure."
}