# CVE-2026-103898: WP Social Login and Register Social Counter authentication bypass

Source: https://junglewise.ai/threats/cve-2026-103898-the-wp-social-login-and-register-social-counter-plugin-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-31. Updated: 2026-10-31  
License: CC BY 4.0 with a link back

CVE-2026-103898 · Severity: high · CVSS 8.1 · Published 2026-10-31

A WordPress plugin that allows users to log in via social media accounts (Facebook, Twitter) has a critical flaw that lets attackers take over any user account without knowing their password. An attacker who controls a social media account with the same email address as a target WordPress user can gain full access to that account, including administrator accounts, compromising the entire website.

Vendors: [WordPress.org](https://junglewise.ai/threats/vendors/wordpress-org).

## Quick answers

**Is CVE-2026-103898 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103898 being exploited in the wild.

**How severe is CVE-2026-103898?** High severity, with a CVSS score of 8.1, published 31 October 2026.

**Which products and versions are affected?** WordPress.org WP Social Login and Register Social Counter up to and including 3.2.2.

**Is there a fix for CVE-2026-103898?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103898 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103898?** Check whether you run WordPress.org WP Social Login and Register Social Counter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin's REST endpoint at `/wp-json/wslu-social-login/type/{provider}/` has `permission_callback => __return_true`, making it unauthenticated. It looks up WordPress users by email from the OAuth provider response and calls `wp_set_auth_cookie()` without password verification. The email verification check (`!empty($getProfile->emailVerified)`) is ineffective because the bundled Facebook and Twitter adapters return the raw email string instead of a boolean flag, allowing the bypass. An attacker controlling an OAuth account with a matching email can impersonate any target user.

## Affected products

- wordpress.org WP Social Login and Register Social Counter up to and including 3.2.2

## Timeline

- 2026-10-31: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php](https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php)
- [https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php](https://plugins.trac.wordpress.org/browser/wp-social/tags/3.2.1/inc/admin-create-user.php)