The vulnerability in the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin allows an attacker to perform an unauthenticated authentication bypass. The plugin’s publicly accessible login handler performs no authentication, authorization, or nonce verification, enabling any user to obtain a valid session cookie for any existing user account, including the site’s original administrator. This flaw provides a complete loss of confidentiality, integrity, and availability for an affected WordPress site.

WordPress sites that have installed the Social Login & Sharing buttons with Analytics By SoClever plugin, version 1.2.0 or earlier, are at risk. No other vendors or products are involved, so the exposure is limited to these particular plugin releases.

The lack of authentication checks means exploitation is straightforward, usually through a standard HTTP request to the vulnerable login URL. The CVSS base score of 9.8 indicates critical severity. The current EPSS score of less than 1% suggests a low probability of widespread exploitation, yet the potential impact remains high. The vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is likely a remote, unauthenticated HTTP request to the plugin’s public login handler.