CVE-2026-77000 in WP Social Media Login Plugin
Summary
by MITRE • 08/22/2026
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in WP Social Media Login versions through 1.0.6 represents a critical authentication bypass flaw rooted in improper verification of third-party identity provider responses. This plugin facilitates single sign-on capabilities for WordPress sites by integrating with external social media platforms such as Facebook, Google, or Twitter to authenticate users. The core technical failure lies in the application logic that handles the callback from these providers. When a user initiates a login via a social platform, the provider redirects back to the WordPress site with an authentication token or code. However, the plugin fails to rigorously validate that this redirection actually resulted from a successful and completed authentication session at the identity provider's end. Instead of verifying the integrity of the OAuth flow or ensuring that the user has explicitly consented and been authenticated by the external service, the application accepts the incoming request parameters with insufficient scrutiny. This lack of state verification allows an attacker to manipulate the login process entirely on their own terms without ever interacting with the social media platform's authentication servers.
From a technical perspective, this flaw is classified under CWE-287, which denotes Improper Authentication, and more specifically aligns with CWE-345 regarding Insufficient Verification of Data Authenticity. The vulnerability enables unauthenticated attackers to bypass all security controls associated with user login by exploiting the trust relationship between the WordPress application and its social providers. By supplying a target victim's email address in the request parameters sent back from what appears to be a social login callback, an attacker can trick the system into creating or logging into an account for that specific user. If the email address already exists within the WordPress database, the attacker gains immediate access as that user. This is particularly dangerous because it allows privilege escalation if the targeted email corresponds to an administrator account. The attack does not require any prior knowledge of passwords, security keys, or multi-factor authentication tokens associated with the victim's social media accounts, making it a highly effective and low-effort exploitation vector for malicious actors targeting WordPress installations using this specific plugin.
The operational impact of this vulnerability is severe, as it compromises the integrity of user identity management on affected websites. Attackers can gain unauthorized access to any existing account by simply knowing the email address associated with that account. This capability facilitates a range of malicious activities including data theft, defacement, malware distribution, and further lateral movement within the network if the compromised WordPress instance is connected to other internal systems. For administrative accounts, this could lead to complete control over the website's content management system, database access, and potentially server-level privileges depending on how the application is deployed. The ease of exploitation means that automated scanning tools can rapidly identify vulnerable instances across the internet, leading to widespread compromise if patches are not applied promptly. This type of vulnerability undermines the fundamental security principle that authentication must be verified through a trusted chain of events rather than relying solely on client-supplied data.
To mitigate this risk, immediate action is required by site administrators and developers. The primary remediation step is to update the WP Social Media Login plugin to version 1.0.7 or later, where the vendor has implemented proper verification mechanisms for social login callbacks. This typically involves validating OAuth state parameters, ensuring that tokens are exchanged correctly with the identity provider's API rather than trusting client-side data directly, and verifying user existence before allowing session creation. In addition to updating software, organizations should implement defense-in-depth strategies such as Web Application Firewalls configured to detect anomalous authentication patterns and rate limiting on login endpoints. Regular security audits and penetration testing focused on authentication flows are recommended to identify similar logic flaws in other plugins or custom code. Adhering to secure coding standards that emphasize strict validation of all external inputs, particularly those related to identity management, is essential for maintaining robust web application security posture.