EUVD-2026-64226
GHSA-rpcc-rx9m-g3cx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Publicly reachable handler with no auth/nonce checks grants an unauthenticated admin session (PR:N/UI:N/AC:L), yielding full admin control over the site, so C/I/A all High.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.
AnalysisAI
Full authentication bypass in the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin (versions up to and including 1.2.0) lets a remote unauthenticated attacker mint a valid session for any existing user, including administrators. Because one publicly reachable login handler performs no authentication, authorization, or nonce validation, an attacker can take over the site's original admin account in the default configuration without knowing any credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The prerequisite is simply that the target WordPress site has the Social Login & Sharing buttons with Analytics By SoClever plugin (≤1.2.0) installed and active, exposing its public login handler. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals partially conflict and should be read together. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who identifies a WordPress site running this plugin sends a single crafted request to the unauthenticated login handler; the handler issues a valid session cookie for the site's original administrator account without any credentials. The attacker then browses to wp-admin as a full administrator and installs a malicious plugin or PHP webshell to persist. … |
| Remediation | No vendor-released patch version is identified in the available data; the vulnerability is listed as affecting all versions through 1.2.0 with no confirmed fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, scan all WordPress installations to identify if Social Login & Sharing buttons with Analytics By SoClever plugin versions 1.2.0 or earlier are installed; disable or deactivate the plugin immediately to eliminate the attack vector. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today