Executive brief
The SoClever WordPress plugin, which provides social login and analytics features for WordPress sites, contains a critical authentication flaw that allows attackers to gain unauthorized access as any site user, including administrators, without knowing their credentials. An attacker can obtain a valid admin session on the default WordPress installation simply by accessing a publicly exposed login handler, potentially leading to complete site compromise including data theft, malware installation, and operational disruption.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the plugin's login handler. The affected component fails to perform any authentication, authorization, or nonce validation on a publicly accessible endpoint, allowing unauthenticated attackers to obtain valid sessions as arbitrary users. The attack requires only network access to the WordPress site and no user interaction or credentials; the default configuration grants access to the site's original administrator account immediately. No patch is currently available as of the public disclosure date.
Affected products
- SoClever Social Login & Sharing buttons with Analytics through 1.2.0
Timeline
- 2026-08-20: disclosed
- 2026-08-22: advisory