WP Social Media Login EUVD-2026-64225

The target site must have the WP Social Media Login plugin (version ≤1.0.6) installed and active with the social-login feature reachable. Exploitation requires only that the attacker know or guess a valid existing user's email address (administrator emails are frequently discoverable), and it works against default configurations since the flaw is in the core authentication logic rather than an optional setting. Limiting factors are minimal: no authentication, no user interaction, and no special privileges are needed (AV:N/AC:L/PR:N/UI:N); the practical constraints are that the vulnerable plugin must be present and the attacker must supply the email of an account that already exists on the site.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) is internally consistent with the description: a remote, unauthenticated attacker with no user interaction can gain full administrator access, which on WordPress means complete site compromise. Working against that severity, the EPSS score is low (0.15%, 4th percentile), and there is no KEV listing and no known public exploit, suggesting the flaw is not yet being weaponized at scale. However, EPSS reflects observed/predicted exploitation volume, not ease - the exploit is technically trivial (submit a known admin email), so the low EPSS should be read as 'not yet widely exploited' rather than 'hard to exploit.' The main real-world limiter is deployment footprint: this is a niche plugin, not a ubiquitous one, so any operator running it should treat this as urgent and patch or remove it immediately, while broad internet-wide mass exploitation is less likely given small install base. Overall this is a genuine high-priority issue for affected sites despite the low EPSS.

An attacker identifies a target WordPress site running WP Social Media Login and determines an administrator's email address (often visible in author archives, post metadata, or public sources). They send a crafted request to the plugin's social-login handler asserting a completed login for that email; the plugin authenticates them as the administrator without ever contacting the identity provider, granting full dashboard access. No public proof-of-concept is currently identified, but the low complexity means one would be straightforward to produce.