WooCommerce Social Login CVE-2026-8457

Exploitation requires that the WooCommerce - Social Login plugin (version 2.8.7 or earlier) is installed and its 'Sign in with Apple' login handler is enabled/reachable, and that the attacker knows or can guess a valid registered email address for the target account (administrator emails are frequently discoverable). The gating security nonce is not a real limiting factor because the plugin exposes it to unauthenticated users via a localized JavaScript object on the login page. Given AV:N/AC:L/PR:N/UI:N, there is no authentication, no user interaction, and no non-default hardening needed beyond having the Apple login feature active - the primary practical limits are that the plugin must be present with Apple login turned on and the attacker must supply a valid target email.

This is a genuine top-priority issue, not a high-CVSS-but-low-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is fully consistent with the described mechanism: exploitation is remote, requires no authentication (the gating nonce is publicly exposed), needs no user interaction, and yields full administrator takeover. Forging an unsigned JWT payload is trivial and fully automatable, and an admin's email is often easy to discover, so the practical barrier is very low. No EPSS score, KEV entry, or POC was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. However, the simplicity of the bug and the value of admin takeover on e-commerce sites make weaponization straightforward, so the absence of a published POC should not lower urgency. Under an SSVC-style read: exploitation is not yet observed but is highly likely, the attack is automatable, and technical impact is total - supporting an 'act now' posture.

An attacker loads the target store's login page, scrapes the publicly exposed social-login nonce from the localized JavaScript object, and crafts an Apple id_token whose base64 payload contains the administrator's email address. They submit this forged, unsigned token to the plugin's Apple login handler, which decodes the email, matches it to the admin account without checking the JWT signature or claims, and issues a valid authenticated session - granting full administrator control. No public exploit code is identified at time of analysis, but the technique requires only standard HTTP tooling given the network vector and low complexity.