Directorist Social Login CVE-2026-22337

Exploitation requires the Directorist Social Login plugin to be actively installed and at least one social authentication provider (Google, Facebook, Twitter, LinkedIn, etc.) to be configured and enabled in plugin settings. Default WordPress installations do not include this plugin - site administrators must explicitly install and configure social login functionality. The privilege escalation occurs during the account creation or account linking process when users authenticate via social providers, meaning the vulnerable code path is only reachable when social login features are operational. No special attacker privileges, user interaction beyond standard social login flow, or non-default WordPress configurations are required once the plugin is active. Attack vector is network-based (AV:N) with low complexity (AC:L), meaning any remote attacker with internet access can exploit vulnerable installations. Sites that installed the plugin but disabled all social login providers are not exposed to the attack surface. Limiting factor: exploitation requires the attacker to successfully complete OAuth flow with a social provider account (attacker-controlled or compromised), which introduces minimal barrier as free social media accounts are readily available.

This represents a critical real-world risk despite absence from CISA KEV. CVSS 9.8 (Critical) is justified: network attack vector (AV:N) allows internet-wide exploitation, low complexity (AC:L) indicates no race conditions or timing requirements, no privileges required (PR:N) means unauthenticated attackers can exploit, no user interaction (UI:N) enables automation, and full CIA triad impact (C:H/I:H/A:H) allows complete site compromise. The vulnerability is likely automatable given the lack of complexity barriers - attackers could mass-scan WordPress sites with the plugin active and automatically trigger social login flows with crafted OAuth callbacks to gain admin access. Patchstack disclosure suggests vulnerability details are known to security researchers, increasing likelihood of weaponization. Primary risk mitigation: patch availability (version 2.1.4) means organizations can remediate immediately. Unknown factors that temper urgency: EPSS score not provided (suggests potentially low observed exploitation if available), no confirmation of public POC, and social login plugins typically require explicit site administrator configuration (not enabled by default in WordPress core), reducing attack surface to sites actively using social authentication features. Security teams should prioritize this for any WordPress installations with Directorist Social Login plugin versions below 2.1.4, especially customer-facing or multi-author sites where unauthorized admin access has severe business impact.

Attacker identifies WordPress site running vulnerable Directorist Social Login plugin through automated scanning (wp-content/plugins/directorist-social-login detection). Attacker initiates social login flow via site's login page using a controlled social media account (e.g., attacker-owned Google account). During OAuth callback processing, vulnerable plugin incorrectly assigns administrator role instead of default subscriber role due to missing privilege validation logic. Attacker gains full WordPress admin dashboard access without site owner interaction, enabling installation of backdoors, malicious plugins, defacement, data exfiltration, or ransomware deployment. Entire attack completes in under one minute with publicly available social media credentials.