Executive brief
The WooCommerce - Social Login WordPress plugin fails to properly validate Apple's authentication tokens, allowing unauthenticated attackers to forge login credentials and gain immediate access to any WordPress account, including administrator accounts. This authentication bypass does not require user interaction and puts all WordPress sites using this plugin at immediate risk of account takeover and unauthorized administrative access.
Technical details
The vulnerability is an authentication bypass in the Apple login handler caused by improper JWT validation. The plugin accepts Apple's id_token but only base64-decodes its payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims. Additionally, the security nonce required to invoke the login flow is publicly exposed in a localized JavaScript object on the login page, accessible to unauthenticated users. An attacker can craft a forged id_token with a target user's email address in the payload and use the exposed nonce to authenticate as that user. The vulnerable component does not perform role-based exclusion, enabling account takeover of any user including administrators. Patches are required to implement proper JWT signature verification against Apple's public key infrastructure and to protect the security nonce from public disclosure.
Affected products
- WooCommerce Social Login up to and including 2.8.7
Timeline
- 2026-08-02: disclosed