Description
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined with the security nonce required to invoke the login flow being publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying a forged id_token whose payload contains the target user's email address, as that email is used without any role exclusion to resolve a WordPress account and immediately issue an authenticated session for it.
Published: 2026-08-01
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WooCommerce – Social Login plugin for WordPress contains a critical authentication bypass flaw. The plugin accepts Apple id_token JWTs without verifying the signature, issuer, audience or expiration, and the login nonce is exposed in a public JavaScript object. An unauthenticated attacker can craft a signed‑like token with any target email and bypass authentication, logging in as any WordPress user, including administrators.

Affected Systems

Any WordPress installation running WooCommerce – Social Login version 2.8.7 or earlier is vulnerable. The issue affects the plugin’s Apple login handler in all affected releases, regardless of the WordPress site configuration.

Risk and Exploitability

With a CVSS score of 9.8 and an EPSS of less than 1%, this vulnerability presents a high‑impact, low‑probability exploitation scenario. Because the nonce is publicly available and the JWT is not validated, an attacker can exploit this remotely without authentication. The vulnerability is not currently listed in the CISA KEV catalog, but remediation is strongly recommended due to the severity.

Generated by OpenCVE AI on August 4, 2026 at 11:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade WooCommerce – Social Login to the latest supported release to ensure JWT signature validation and nonce protection.
  • If the plugin cannot be upgraded or is not needed, remove it entirely from the WordPress installation.
  • Verify that Apple login JWTs are validated for signature, issuer, audience, and expiration before authenticating users.

Generated by OpenCVE AI on August 4, 2026 at 11:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpweb
Wpweb woocommerce Social Login
Vendors & Products Wordpress
Wordpress wordpress
Wpweb
Wpweb woocommerce Social Login

Sun, 02 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Description The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined with the security nonce required to invoke the login flow being publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying a forged id_token whose payload contains the target user's email address, as that email is used without any role exclusion to resolve a WordPress account and immediately issue an authenticated session for it.
Title WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
Weaknesses CWE-289
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Wordpress Wordpress
Wpweb Woocommerce Social Login
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-03T18:55:40.237Z

Reserved: 2026-05-13T05:50:34.984Z

Link: CVE-2026-8457

cve-icon Vulnrichment

Updated: 2026-08-03T18:55:37.390Z

cve-icon NVD

Status : Deferred

Published: 2026-08-02T00:16:23.047

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-8457

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T11:15:06Z

Weaknesses
  • CWE-289

    Authentication Bypass by Alternate Name