What is the CVSS score of CVE-2026-65542?

CVE-2026-65542 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Super Socializer are affected by CVE-2026-65542?

The Super Socializer WordPress plugin versions 7.14.5 and earlier contain a broken authentication vulnerability (CVE-2026-65542) that allows unauthenticated attackers to bypass social login…

How to fix or mitigate CVE-2026-65542?

Within 24 hours: Conduct a comprehensive audit of all WordPress instances to identify those running Super Socializer plugin version 7.14.5 or earlier; document the number of accounts using social login functionality and the criticality of affected systems. Within 7 days: Deploy enhanced login monitoring to detect anomalous authentication patterns; enable detailed audit logging for all social login attempts; if feasible, disable the Super Socializer social login feature entirely. Within 30 days: Monitor the Super Socializer vendor security advisory channel for a patched version release; if no patch becomes available and social login remains essential to business operations, evaluate and plan migration to an alternative WordPress social authentication plugin with active security support.

Super Socializer CVE-2026-65542

EUVD-2026-53972 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-06 Patchstack

GHSA-4vxp-4cw9-qfhc

WordPress Information Disclosure Super Socializer Wordpress Plugin

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible social login callback requires no attacker privileges but needs victim interaction (UI:R); full account takeover justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:30 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 8.8

DescriptionCVE.org

Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.

AnalysisAI

Super Socializer plugin for WordPress (versions ≤ 7.14.5) contains a broken authentication vulnerability (CWE-288) that permits unauthenticated remote attackers to bypass the social login authentication mechanism and gain unauthorized access to WordPress user accounts. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates low-complexity network exploitation requiring victim interaction, consistent with a social login callback or token-verification bypass where a victim must initiate or interact with the login flow. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high CVSS score (8.8) and full C/I/A impact reflect the potential for complete account takeover.

Technical ContextAI

Super Socializer (CPE: cpe:2.3:a:rajat_varlani:super_socializer:*:*:*:*:*:*:*:*) is a WordPress plugin that implements social login and social sharing, allowing site visitors to authenticate via third-party identity providers such as Facebook, Google, and Twitter. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates the plugin exposes an alternative code path - typically a social login callback endpoint or token-verification handler - that can be reached or manipulated without completing the intended authentication handshake. In WordPress social login plugins, this class of flaw commonly manifests as server-side acceptance of attacker-supplied user identifiers (e.g., social network user ID or email) without cryptographically verifying the accompanying OAuth token or nonce, allowing an attacker to impersonate any registered user whose identifier is known or guessable. The UI:R flag in the CVSS vector suggests the exploit path may require a victim to initiate or interact with the social login flow, consistent with a redirect-manipulation or CSRF-assisted variant.

RemediationAI

The primary remediation is to update the Super Socializer plugin to a version beyond 7.14.5 once a patched release is published by the vendor; no specific fixed version number was confirmed in the available input data (see confidence notes). Administrators should monitor the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/super-socializer/vulnerability/wordpress-super-socializer-plugin-7-14-5-broken-authentication-vulnerability for patch availability. As an interim compensating control, disable the social login feature within the plugin settings to remove the vulnerable authentication path - this eliminates the attack surface at the cost of social login functionality for site users. If disabling social login is not operationally feasible, consider temporarily deactivating the plugin entirely via the WordPress admin panel until a patch is available. Restricting access to the plugin's callback or authentication endpoints via WAF rules targeting the plugin's known URL paths is a partial mitigation but may not cover all exploit variants. Enforce strong, unique passwords and multi-factor authentication on all WordPress admin accounts to limit the blast radius if user-level authentication bypass is achieved.