SoClever Social Login EUVD-2026-64226

The prerequisite is simply that the target WordPress site has the Social Login & Sharing buttons with Analytics By SoClever plugin (≤1.2.0) installed and active, exposing its public login handler. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special conditions - remote unauthenticated exploitation works against the default configuration, and in the default case the session obtained is that of the site's original administrator account with no need to know any usernames or IDs. Limiting factors are narrow: exploitation is bounded only by whether the plugin is installed and network-reachable; there is no required authentication, no user interaction, and no non-default setting needed. Targeting a non-default (non-original-admin) account may require knowing that account exists, but administrator takeover in the common case does not.

The signals partially conflict and should be read together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes the worst case: network-reachable, low-complexity, unauthenticated, no user interaction, leading to full admin compromise - consistent with the description that a default install yields the original administrator's session. Against that, EPSS is only 0.19% (9th percentile), the CVE is NOT on CISA KEV, and no public PoC is referenced, so there is currently no evidence of active or automated exploitation. The realistic read: this is a genuinely high-priority patch/removal item because exploitation is trivial and impact is total once a working request is known, but real-world exploitation today appears limited by the plugin's likely small install base and the absence of published exploit code. EPSS reflects observed activity, not difficulty - do not let the low score downgrade urgency for sites that actually run this plugin. Note the low EPSS despite a critical vector is explained by prevalence, not by any mitigating technical factor.

An attacker who identifies a WordPress site running this plugin sends a single crafted request to the unauthenticated login handler; the handler issues a valid session cookie for the site's original administrator account without any credentials. The attacker then browses to wp-admin as a full administrator and installs a malicious plugin or PHP webshell to persist. No public exploit code is identified at time of analysis, but the attack requires no authentication, no user interaction, and low complexity.