The vulnerability allows an unauthenticated actor to obtain an authenticated session as any WordPress user. The flaw resides in the social login REST callback, which accepts the OAuth provider’s email string without verifying the account or checking a password. Because the plugin treats the provider’s email as permanently verified, it directly calls wp_set_auth_cookie(), giving the attacker full access to the target’s account. The attacker can perform any action the account is authorized for, including administrative functions, content manipulation, or data exfiltration.

This issue affects installations of the roxnor WordPress plugin "Wp Social Login and Register Social Counter" up to and including version 3.2.2. Any WordPress site using this plugin for Facebook or Twitter authentication is potentially vulnerable. The vulnerability is present regardless of how the plugin is configured, as the underlying code flaw is independent of user settings.

The vulnerability carries a CVSS score of 8.1, indicating high severity. No EPSS score is available and the issue is not listed in CISA's KEV catalog. The attack can be performed by an attacker who controls an OAuth account whose email matches a WordPress user’s registered email address; no further access or credentials are required. Given the ease of exploitation and the potential for complete account takeover, the risk to affected sites is significant.