Loading vulnerability…
Authentication Bypass in WooCommerce - Social Login Apple Login Flow
CVE-2026-8457 is a critical authentication bypass vulnerability in the WooCommerce - Social Login plugin for WordPress affecting all versions up to and including 2.8.7. The flaw is in the plugin's Apple login handler, which accepts an Apple id_token JWT and decodes only its base64 payload without verifying the token signature against Apple's public keys and without validating key claims such as issuer, audience, or expiry. The attack is further enabled because the nonce required to invoke the login flow is exposed to unauthenticated users through client-side login page data. An attacker can forge an id_token containing the email address of any existing WordPress user, causing the plugin to resolve that account and immediately establish an authenticated session without additional identity verification or role restrictions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthenticated remote attackers to log in as any existing WordPress user, including administrators. When an administrator account is targeted, the result can be full site compromise, including unauthorized administrative actions, content and configuration changes, user management abuse, data theft, payment-flow tampering on WooCommerce deployments, and potential malware deployment. The reported severity is critical, with impacts to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable the Apple login feature or disable the WooCommerce - Social Login plugin entirely until the fixed version is deployed. Defenders should also review administrator accounts, active sessions, and authentication logs for suspicious social-login activity and invalidate potentially compromised sessions.
Patch, then assume compromise.
Upgrade the WooCommerce - Social Login plugin to version 2.8.8 or later, which fixes the vulnerable Apple login flow. The remediation requires proper verification of Apple id_token JWT signatures against Apple's public keys and validation of relevant claims including issuer, audience, and expiry before any account resolution or session issuance occurs.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.