Executive brief
The login-social WordPress plugin, used to enable third-party account sign-in on WordPress sites, fails to properly validate password reset requests or authenticate users logging in via social providers. This allows attackers to reset any user's password—including administrators—or gain unauthorized access to any account without needing valid credentials, leading to complete compromise of the affected WordPress site.
Technical details
The plugin suffers from multiple authentication bypass vulnerabilities: it does not validate password-reset requests against a reset key or verify the requester's identity, and it accepts authentication sessions from unverified third-party sign-in data (CWE-287: Improper Authentication). An unauthenticated network attacker can exploit this by issuing arbitrary password-reset requests or crafting forged third-party authentication claims to impersonate any user, including site administrators. No user interaction or authentication is required. The vulnerability affects version 1.0.4 and earlier; a patch status is not currently documented.
Affected products
- Huge IT Login (login-social) through 1.0.4
Timeline
- 2026-07-21: disclosed
- 2026-08-02: advisory