Loading story…
A critical authentication bypass vulnerability, tracked as CVE-2026-8457, affects the WooCommerce - Social Login WordPress plugin by WPWeb in all versions through 2.8.7. The flaw allows unauthenticated attackers to log in as any existing WordPress user, including administrators, by forging an Apple id_token JWT with a victim's email address. Researchers said the plugin's Apple login handler decodes the token payload but does not verify the JWT signature against Apple's public keys or validate core claims such as issuer, audience, and expiry.
The attack is further enabled by a login-flow nonce that is exposed to unauthenticated users through a localized JavaScript object on the login page. The issue has a CVSS 9.8 rating and is classified as CWE-289, reflecting the risk of full account takeover and complete site compromise when an administrator account is targeted. The vulnerability is fixed in 2.8.8, and public reporting said no active exploitation had been confirmed at the time of disclosure.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE entry states that the new CVE was received by security@wordfence.com. The record identifies the issue as CWE-289 and describes impact up to administrator account compromise.
CVE-2026-8457 was publicly disclosed as a critical authentication bypass in the WooCommerce - Social Login WordPress plugin. The flaw stems from accepting forged Apple id_token JWTs without proper signature and claim validation, enabling account takeover.
Version 2.8.8 of the WooCommerce - Social Login plugin was released to fix CVE-2026-8457. The issue affects all versions up to and including 2.8.7.
The authentication bypass vulnerability in the WooCommerce - Social Login plugin was discovered by Rafie Muhammad of Awesome Motive. The flaw affects the plugin's Apple login flow and can allow login as arbitrary existing users via a forged Apple id_token.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical broken authentication flaw tracked as **CVE-2026-57807** affects the miniOrange **OAuth Single Sign On - SSO (OAuth Client)** WordPress plugin and allows unauthenticated remote attackers to compromise vulnerable sites. The issue impacts plugin versions **through 38.5.8** and is classified as **CWE-288**. According to public reporting and the CVE entry, the bug abuses the plugin's password recovery flow to let an attacker authenticate as arbitrary WordPress users, including administrators, creating a direct path to full website takeover. The vulnerability carries a **CVSS 9.8** rating and is considered low complexity and remotely exploitable with no user interaction required. Patchstack disclosed the issue and warned it is likely to face mass exploitation, while noting that no official vendor patch was available at the time of reporting. Defenders were urged to immediately remove the affected plugin or limit exposure to WordPress login and password recovery endpoints until miniOrange releases a fix; Patchstack also said it had issued a virtual patch for protected customers.
Jul 13, 2026
A critical authentication bypass vulnerability, tracked as **CVE-2026-15014**, affects the **SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery** WordPress plugin in versions through `3.9.7`. The flaw stems from the plugin trusting a session-level `$_SESSION['sa_mobile_verified']` flag that is not bound to the specific phone number that completed OTP verification. An unauthenticated attacker can verify a phone number they control, then resubmit registration data with a victim’s `billing_phone` value and trigger `wp_set_auth_cookie()` for the victim account. The bug carries a **CVSS 9.8** severity rating and can allow takeover of any existing WordPress user whose registered phone number is known or guessable, including administrators, potentially leading to full site compromise. Reports say public proof-of-concept details are available and exploitation attempts have already been observed. The issue is fixed in version `3.9.8`, and defenders are being urged to update immediately or temporarily disable the plugin while ensuring OTP verification is tied to the verified phone number.
Jul 28, 2026
Three high-severity flaws in **LoginPress Pro** for WordPress can let unauthenticated attackers log in as existing site users, including administrators, by abusing weaknesses in the plugin’s OAuth-based social login flows. The issues, tracked as `CVE-2026-12595`, `CVE-2026-12597`, and `CVE-2026-12598`, affect versions through **6.2.3** and carry **CVSS 8.1** ratings. Researchers said the free version of LoginPress is not affected, while the premium plugin has more than **50,000 active installations**. The bypasses stem from insufficient verification of email data returned by OAuth providers. In the GitHub flow, the plugin trusts the first email returned by the `/user/emails` endpoint without confirming it is verified, while the Spotify Social Login addon accepts the email from Spotify’s `/v1/me` endpoint and uses it to identify and authenticate WordPress users. An attacker can add or create a matching email address on a third-party account and then trigger the OAuth callback to gain access as the targeted WordPress user. The vulnerabilities were disclosed through **Patchstack**, credited to **Dmitrii Ignatyev**, and fixed in **LoginPress Pro 6.2.4**; organizations that cannot patch immediately are advised to disable affected social login features.
Jul 10, 2026