The vulnerability allows an attacker to forge an Apple OAuth authentication request that is insufficiently validated by the Nextend Social Login Pro plugin. This flaw enables an unauthenticated attacker to log in as any existing WordPress user—including administrators—provided the attacker knows the user’s email address. Once authenticated, the attacker gains full privileges of that account.

The issue affects the Nextend Social Login Pro plugin for WordPress, versions up to and including 3.1.16. The plugin is distributed by Nextendweb.

The CVSS score of 9.8 indicates high severity, while the EPSS score of less than 1% suggests a low but non-zero probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the weakness remotely by crafting a specially crafted request to the Apple OAuth endpoint exposed by the plugin; the likely attack vector is inferred from the description as a remote request that bypasses authentication. Because the bypass is triggered without prior authentication, an attacker could elevate their privileges to that of any existing user on the site.