What is the CVSS score of CVE-2026-16261?

CVE-2026-16261 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of login-social are affected by CVE-2026-16261?

The login-social WordPress plugin (≤1.0.4) contains an authentication bypass vulnerability allowing unauthenticated attackers to reset any user password and assume administrator rights, enabling…

Is there a public PoC exploit available for CVE-2026-16261?

Yes, a public proof-of-concept exploit is available for CVE-2026-16261. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16261?

Within 24 hours, inventory all WordPress installations to identify whether login-social plugin version 1.0.4 or earlier is active, and document all user accounts with administrative privileges. Within 7 days, disable the plugin across all affected sites, or if operationally essential, implement network-level IP restrictions on WordPress login pages and enforce multi-factor authentication for all accounts. Within 30 days, evaluate permanent solutions including plugin removal or replacement with alternative authentication methods, and track the plugin's repository for security patch releases.

login-social CVE-2026-16261

EUVD-2026-51943 HIGH

Improper Authentication (CWE-287)

2026-08-02 WPScan

GHSA-5hm3-fq9v-vwj3

WordPress Authentication Bypass Login Social Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

9.8 CRITICAL

Full unauthenticated admin account takeover yields high C/I/A; network vector with no privileges or user interaction confirmed by description and CVSS AV/PR/UI fields.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 18:26 vuln.today

CVSS changed

Aug 03, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Aug 02, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 02, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as any existing account, including administrators, and take over the site.

AnalysisAI

Complete authentication bypass in the login-social WordPress plugin (≤1.0.4) enables unauthenticated remote attackers to reset any user's password without a valid reset key and to forge login sessions using unverified third-party identity data, giving attackers full administrator access and site takeover capability. Any WordPress site running this plugin is exposed regardless of configuration, as both failures reside in the plugin's core authentication flows. A publicly available exploit exists per WPScan; EPSS sits at 0.19% (9th percentile), suggesting exploitation is targeted rather than widespread at this time, though the public PoC lowers the technical barrier considerably.

Technical ContextAI

The login-social plugin (CPE: cpe:2.3:a:unknown:login-social:*:*:*:*:*:*:*:*, all releases ≤1.0.4) extends WordPress with social/third-party sign-in and a custom password-reset flow. CWE-287 (Improper Authentication) captures two distinct failures baked into its core features: the password-reset endpoint does not validate a CSRF or reset token, nor does it verify the requester's identity before issuing a new credential; and the social login path accepts identity claims from third-party providers without validating them against a server-side nonce or verified session, allowing fabricated identity assertions to produce authenticated WordPress sessions. Both weaknesses share a root cause of missing cryptographic verification at authentication decision points - the plugin trusts attacker-supplied input where it should verify a secret known only to the server.

RemediationAI

No vendor-released patched version has been identified at time of analysis - the highest known release remains 1.0.4. Site administrators should immediately deactivate and remove the login-social plugin from all WordPress installations. If social login or custom password-reset functionality is business-critical, replace it with an actively maintained alternative from the WordPress plugin directory that has a verifiable patch history. As a compensating control while remediation is planned, restrict access to wp-login.php and any plugin-exposed authentication endpoints to known trusted IP ranges at the WAF or web server level; note this limits access for remote or mobile users. Adding monitoring for unexpected admin account password changes or new administrator sessions provides a detection signal for exploitation attempts. Monitor the WPScan vulnerability entry at https://wpscan.com/vulnerability/533f9347-e7cd-4a86-8cb5-f6d4aaaf4dd1/ for patch availability updates.