Super Socializer CVE-2026-65542

The vulnerability requires the Super Socializer plugin to be installed and active on a WordPress site with social login functionality enabled - a non-default WordPress state, since the plugin must be explicitly installed and configured. The CVSS vector PR:N confirms the attacker requires no account or privileges on the target site. UI:R indicates a victim must perform an action (e.g., clicking a crafted link or visiting an attacker-controlled page that initiates the social login redirect), limiting fully automated exploitation. The attack is network-accessible (AV:N) with low complexity (AC:L), meaning no special network position or race condition is required once victim interaction is obtained. Exploitation is limited to sites where social login is actively configured and in use; WordPress installations with the plugin installed but social login not configured or not exposed to end users have reduced exposure. Specific social network provider configurations (Facebook, Google, Twitter OAuth credentials) that trigger the vulnerable code path are not confirmed from available data.

The CVSS base score of 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a high-severity, remotely exploitable flaw requiring no attacker privileges and only user interaction. The three High impact metrics (C/I/A) indicate that successful exploitation results in full compromise of the affected WordPress account, potentially including administrator-level access if an admin account is targeted. The UI:R constraint is a meaningful practical limiter - exploitation is not fully automated and requires a victim to perform some action (e.g., clicking a crafted social login link), reducing automatable mass-exploitation risk compared to UI:N vulnerabilities. No EPSS score was provided in the input data, so probability of near-term exploitation cannot be quantified numerically. No CISA KEV listing is present, indicating no confirmed in-the-wild exploitation at time of analysis. No public proof-of-concept was identified in the provided data. The Patchstack report tag of 'Information Disclosure' alongside 'Super Socializer' suggests the flaw may also leak user data as a precursor or side-effect of authentication bypass. Real-world priority is moderate-to-high for any WordPress site using this plugin with social login enabled, primarily because the attack complexity is low once a victim interaction is obtained.

An attacker targeting a WordPress site running Super Socializer ≤ 7.14.5 crafts a malicious social login URL or callback request that supplies an arbitrary user identifier (such as an email address or social network user ID) without a valid OAuth token. The attacker social-engineers or phishes a victim into clicking the crafted link, triggering the plugin's broken authentication handler. The plugin fails to verify the authentication token and logs the victim's browser session in as the targeted WordPress account, granting the attacker full access to that account's capabilities - including administrative functions if an administrator account is targeted. No public proof-of-concept has been identified at time of analysis.