Description

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-19T07:16:33.167Z",
  "pubdate": "2026-09-19T07:16:33.167Z",
  "executiveSummary": "The UsersWP WordPress plugin prior to version 1.5.10 contains a critical authentication bypass vulnerability stemming from flawed social login implementation. The vulnerability is categorized as an improper verification of cryptographic signatures or email ownership assertion during the OAuth/OpenID handshake process.\nThe flaw allows unauthenticated remote attackers to perform full account takeover of any registered user, including administrative accounts, by manipulating the identity assertion provided by an external social provider. Because the application blindly trusts the email address returned by the social provider without verifying that the provider has validated ownership of that address, an attacker can assert control over an existing account simply by utilizing an email address associated with a target user on the target platform.\nThis vulnerability presents a catastrophic risk to site integrity and data confidentiality, as successful exploitation grants the attacker full access to the target's account privileges. The attack requires no prior authentication and can be executed over the network by any individual capable of initiating a social login flow against the target installation.",
  "technicalDetails": "The root cause of the vulnerability lies in the application's authentication logic during the social login callback process. When a user authenticates via a third-party social provider, the plugin retrieves identity information, specifically the email address, from the provider's API response. The application subsequently attempts to map this identity to an existing local WordPress user account based solely on the email address provided in the OAuth/OpenID payload.\nThe vulnerability manifests because the plugin fails to verify the 'email_verified' or equivalent claims within the identity token provided by the social platform. Even in cases where a social provider indicates that an email address has not been verified by their own internal authentication mechanisms, the plugin proceeds to match the returned email string against the 'wp_users' table. If a match is found, the plugin assumes ownership of the account and initiates a session for the attacker as the target user.\nThe attack flow proceeds as follows: 1) The attacker initiates a social login process via the UsersWP interface. 2) The attacker controls an account on the social provider platform (e.g., a secondary Google or Facebook account) and configures that account with an email address corresponding to a target administrator on the vulnerable WordPress site. 3) The attacker triggers the OAuth callback. 4) The plugin receives the identity payload, extracts the email address, and queries the database for a matching user record. 5) Finding a match for the administrator email, the plugin authenticates the attacker as that administrator, bypassing all secondary password or multi-factor authentication (MFA) requirements that might be present on the local WordPress installation.\nThis allows for unauthorized administrative access, privilege escalation, and potential remote code execution if the attacker subsequently leverages administrative capabilities (such as plugin or theme editing) to deploy malicious payloads. Because the logic is localized to the session handling component of the plugin's integration layer, the vulnerability is exposed to any network-accessible endpoint that initiates the social login authentication sequence. The flaw persists in all versions of the UsersWP plugin prior to 1.5.10."
}