Wp Social Login CVE-2026-103898

The target site must run the Wp Social Login and Register Social Counter plugin (version ≤3.2.2) with the bundled Facebook or Twitter social-login provider configured and active - this is the key limiting factor and is not a WordPress default. The attacker must control an OAuth account on that configured provider (Facebook or Twitter specifically, because only their bundled Hybridauth adapters assign the raw email string rather than a boolean to emailVerified, making the verification guard a no-op) whose provider-returned email exactly matches the victim account's registered WordPress email address. The attacker must therefore know or guess a target user's registered email (e.g. an administrator's). No WordPress credentials, nonce, CSRF token, or prior site foothold is required, and no victim interaction is needed; the REST callback is reachable unauthenticated. Providers other than the vulnerable Facebook/Twitter adapters may not be exploitable.

This is a genuine high-priority issue, not an inflated CVSS number, but its real-world risk is gated by configuration. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) shows an unauthenticated (PR:N), network-reachable, no-interaction authentication bypass that yields full confidentiality, integrity, and availability impact - i.e. complete takeover of any existing account, including Administrator. The AC:H reflects real constraints: the target site must have the bundled Facebook or Twitter social-login configured, and the attacker must control an OAuth account whose provider-returned email matches the victim's registered WordPress email. The vuln.today decision label is 'this_week' (priority, but not emergency). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no evidence of active or widespread exploitation; this suggests the urgency is driven by the severity and ease of the logic flaw rather than observed attacks. Signals are consistent rather than conflicting: a high technical impact tempered by a non-default-configuration prerequisite and the need to match a specific email. Treat as a near-term patching priority for any site using Facebook/Twitter social login via this plugin.

An attacker targets a WordPress site running this plugin (≤3.2.2) with Facebook or Twitter social login enabled and knows an administrator's registered email address. The attacker arranges a Facebook or Twitter OAuth account whose returned email matches that administrator, then triggers the social-login flow against the site's /wp-json/wslu-social-login/type/{provider}/ REST callback; because the endpoint uses permission_callback => __return_true and the emailVerified guard is a no-op for the bundled Facebook/Twitter adapters, the site locates the admin account by email and issues an authenticated session cookie with no password check. No public exploit code is identified in the provided data.