The WP Social Media Login plugin, up to and including version 1.0.6, fails to confirm that an authentication session with the external identity provider (Twitter) was actually completed, permitting an unauthenticated attacker to log in as any existing WordPress user by simply providing that user’s email address. An attacker who succeeds in this process obtains the credentials and privileges of the targeted account, potentially including super‑user rights. This flaw is an example of improper authentication (CWE‑287).

WordPress sites that have the WP Social Media Login plugin installed with a version of 1.0.6 or older are affected. No additional vendor or product variants are listed, and no specific sub‑versions beyond the stated maximum are mentioned.

The exploit requires no prior authentication and can be performed remotely through the normal social‑login interface, merely by submitting an arbitrary email address. Because the flaw allows direct account takeover, it is considered highly impactful. The CVSS score of 9.8 indicates extreme severity, while the EPSS score of <1% shows a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the simplicity of the attack and the magnitude of the potential impact keeps the risk significant.