Login Social
Monthly
Complete authentication bypass in the login-social WordPress plugin (≤1.0.4) enables unauthenticated remote attackers to reset any user's password without a valid reset key and to forge login sessions using unverified third-party identity data, giving attackers full administrator access and site takeover capability. Any WordPress site running this plugin is exposed regardless of configuration, as both failures reside in the plugin's core authentication flows. A publicly available exploit exists per WPScan; EPSS sits at 0.19% (9th percentile), suggesting exploitation is targeted rather than widespread at this time, though the public PoC lowers the technical barrier considerably.
Complete authentication bypass in the login-social WordPress plugin (≤1.0.4) enables unauthenticated remote attackers to reset any user's password without a valid reset key and to forge login sessions using unverified third-party identity data, giving attackers full administrator access and site takeover capability. Any WordPress site running this plugin is exposed regardless of configuration, as both failures reside in the plugin's core authentication flows. A publicly available exploit exists per WPScan; EPSS sits at 0.19% (9th percentile), suggesting exploitation is targeted rather than widespread at this time, though the public PoC lowers the technical barrier considerably.