Executive brief
WP Social Media Login is a WordPress plugin that allows users to sign in using social media accounts such as Twitter. The plugin fails to verify that a social login was actually completed with the identity provider before granting access, enabling attackers to log in as any user—including administrators—by simply providing an existing user's email address. This bypasses all authentication controls and can lead to complete account takeover.
Technical details
This is an authentication bypass vulnerability (CWE-287) in the social login flow of WP Social Media Login through version 1.0.6. The root cause is a missing verification step: the plugin does not confirm that the social login attempt was actually completed and verified by the identity provider (e.g., Twitter) before authenticating the user. An unauthenticated attacker can exploit this by directly supplying an existing user's email address to the affected code path, which only runs on single-site WordPress installations. If the supplied email matches a valid account, the attacker gains full authenticated access to that account, including administrator accounts. If no matching account exists, the plugin creates a new account and logs the attacker in regardless of the site's user registration settings. No known fix is currently available.
Affected products
- WP Social Media Login WP Social Media Login through 1.0.6
Timeline
- 2026-08-20: disclosed
- 2026-08-22: other: CVE assigned