EUVD-2026-51920
GHSA-qwc9-q2f8-q72q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, no auth (nonce publicly exposed) and no interaction to forge an unsigned token, yielding full admin takeover, so PR:N/UI:N with C/I/A all High.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined with the security nonce required to invoke the login flow being publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This makes it possible for unauthenticated attackers to log in as any existing WordPress user - including administrators - by supplying a forged id_token whose payload contains the target user's email address, as that email is used without any role exclusion to resolve a WordPress account and immediately issue an authenticated session for it.
Articles & Coverage 1
AnalysisAI
Authentication bypass in the WooCommerce - Social Login plugin for WordPress (all versions up to and including 2.8.7) lets unauthenticated attackers log in as any existing user, including administrators, by forging an Apple id_token containing the victim's email address. The Apple login handler base64-decodes the JWT payload but never verifies the token signature against Apple's public keys nor validates the issuer, audience, or expiry claims, and the nonce needed to trigger the flow is publicly leaked to anonymous visitors. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis.
Technical ContextAI
The affected component is the plugin's 'Sign in with Apple' OAuth/OpenID Connect handler. In a correct implementation, Apple returns a signed JWT (id_token) whose signature must be validated against Apple's published JWKS public keys, and whose iss (issuer, https://appleid.apple.com), aud (client_id), and exp (expiry) claims must be checked before the identity is trusted. Here the handler treats the middle segment of the JWT purely as an opaque base64 blob, decodes it, and reads the email claim directly, skipping all cryptographic and claim validation. This is a textbook CWE-289 (Authentication Bypass by Alternate Name): the plugin trusts an attacker-controllable token as proof of identity. Compounding the flaw, the WordPress security nonce that gates invocation of the login endpoint is emitted into a localized JavaScript object (wp_localize_script) on the public login page, so it is readable by any unauthenticated user and provides no protection. The resolved email is matched to a WordPress account with no role exclusion, so administrator accounts are equally reachable.
RemediationAI
No vendor-released patch version is identified in the available data (all versions through 2.8.7 are listed as vulnerable and no fixed release is named), so monitor the CodeCanyon listing and the Wordfence advisory for an update beyond 2.8.7 and apply it immediately once published. As interim compensating controls: disable the 'Sign in with Apple' login option in the plugin settings if it is not essential, which removes the vulnerable code path at the cost of losing Apple social login; or fully deactivate the WooCommerce - Social Login plugin until a fix ships, which disables all social login flows. Where the plugin must stay active, restrict access to the WordPress login/social-login endpoints (for example a WAF rule that blocks or challenges requests to the Apple login handler, or IP-restricting wp-login.php and the admin area), and enable a WordPress security plugin/virtual patch (such as Wordfence) that can block forged-token requests. Additionally rotate credentials and audit sessions and administrator accounts for unexpected logins, since exploitation leaves the attacker with a valid authenticated session. Refer to the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/53e83037-2cc5-4dc9-b55d-03829df12a65?source=cve) for authoritative guidance.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-289 – Authentication Bypass by Alternate Name
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today