What is the CVSS score of CVE-2026-57751?

CVE-2026-57751 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Heateor Social Login are affected by CVE-2026-57751?

The Heateor Social Login plugin for WordPress carries a high-severity security flaw that could allow attackers to compromise user accounts and change website settings without authorization.

How to fix or mitigate CVE-2026-57751?

Within 24 hours: Identify all WordPress installations using Heateor Social Login plugin (versions 1.1.39 and earlier) and disable it immediately. Within 7 days: Review administrative and user account activity logs for unauthorized changes; reset passwords for all WordPress administrator accounts. Within 30 days: Monitor vendor advisories for patch availability; plan migration to an alternative social login solution.

Heateor Social Login CVE-2026-57751

EUVD-2026-41307 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-02 Patchstack

GHSA-g8qg-f769-3pm2

WordPress CSRF Wordpress Plugin Heateor Social Login

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Unauthenticated network CSRF (PR:N) requiring victim interaction (UI:R); High C/I reflect account/config manipulation, no availability impact, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:24 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.

AnalysisAI

Cross-Site Request Forgery in the Heateor Social Login WordPress plugin (versions up to and including 1.1.39) lets an unauthenticated remote attacker forge state-changing requests that are executed with a logged-in victim's privileges once the victim is lured into interacting with a malicious page. The CVSS 3.1 score is 8.1 with High confidentiality and integrity impact, reflecting potential account or configuration manipulation, though exploitation is gated on user interaction (UI:R). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is the Heateor Social Login plugin for WordPress (CPE cpe:2.3:a:heateor_support:heateor_social_login), which adds third-party social/OAuth-style authentication and account-linking to WordPress sites. The root cause is CWE-352 (Cross-Site Request Forgery): one or more of the plugin's state-changing actions do not validate a per-request anti-CSRF nonce or the Origin/Referer header, so the application cannot distinguish a request intentionally issued by the user from one silently triggered by an attacker-controlled page. Because WordPress relies on cookie-based session authentication, the victim's browser automatically attaches valid session cookies to the forged request, causing the server to process it as legitimate.

RemediationAI

No vendor-released patch version was identified in the provided data, so update to the latest available release of Heateor Social Login (any version newer than 1.1.39) as soon as one is published and confirmed via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/heateor-social-login/. Until a fixed release is verified, apply compensating controls: place the WordPress admin and the plugin's action endpoints behind a WAF/virtual patch that enforces Origin/Referer validation on state-changing POST requests (Patchstack offers such virtual patching), restrict wp-admin access to trusted IP ranges to reduce the chance an authenticated victim is targeted, and advise privileged users not to browse untrusted sites while logged into WordPress. The trade-offs are that IP restrictions can disrupt legitimate remote administrators and WAF rules require tuning to avoid breaking the plugin's normal social-login flows. If the plugin is non-essential, deactivating and removing it eliminates the exposure entirely at the cost of losing social-login functionality.