The vulnerability is present in Social Login & Sharing buttons with Analytics By SoClever WordPress plugin version 1.2.0 and earlier. A publicly accessible login handler performs no authentication, authorization or nonce validation, allowing an unauthenticated attacker to obtain a valid session cookie for any existing user, including the site’s original administrator. This flaw enables an attacker to assume full control of a WordPress site without knowing any credentials, constituting a complete loss of confidentiality, integrity and availability for the affected instance.

The affected product is the WordPress plugin Social Login & Sharing buttons with Analytics By SoClever, all releases up to and including 1.2.0. Sites that have installed this plugin are at risk; no other vendors or products are mentioned, so the impact is limited to WordPress sites with the vulnerable plugin.

The lack of authentication checks makes exploitation straightforward, especially for an attacker with network access to the web application. While a current EPSS score is not available, the exposure allows unrestricted session creation, raising the risk of credential abuse. The vulnerability is not yet listed in CISA’s KEV catalog, but the attack surface left by the unauthenticated endpoint means the likely vector is a standard HTTP request to the public login handler.