The login‑social WordPress plugin in all releases up to 1.0.4 fails to verify password‑reset requests against a reset key or the requester's identity, and it issues authentication sessions derived from unverified third‑party sign‑in data. As a result, an attacker can reset any user’s password or log in as any existing account—including administrators—without needing any credentials, thereby gaining full control over the site’s administrative and user accounts.

WordPress installations that employ the login‑social plugin with a version equal to or less than 1.0.4 are affected. No other plugins or products are listed as impacted.

The vulnerability can be triggered solely through standard web requests, so the attack vector is remote and requires no prior authentication. With a CVSS score of 7.5 and an EPSS score below 1%, and no listing in CISA’s KEV catalog, exploitation appears uncommon but the impact remains severe, granting unrestricted access to administrative accounts. Administrators should treat this as a high‑risk security flaw and address it immediately.