The WP Social Media Login plugin, up to and including version 1.0.6, fails to confirm that an authentication session with the external identity provider (Twitter) was actually completed, permitting an unauthenticated attacker to log in as any existing WordPress user by simply providing that user’s email address. An attacker who succeeds in this process obtains the credentials and privileges of the targeted account, potentially including super‑user rights. This flaw is an example of improper authentication (CWE‑287).

WordPress sites that have the WP Social Media Login plugin installed with a version of 1.0.6 or older are affected. No additional vendor or product variants are listed, and no specific sub‑versions beyond the stated maximum are mentioned.

The exploit requires no prior authentication and can be performed remotely through the normal social‑login interface, merely by submitting an arbitrary email address. Because the flaw allows direct account takeover, it is considered highly impactful. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, but the risk remains significant due to the simplicity of the attack and the severity of the impact.