External risk intelligence

WP Social Media Login Unauthenticated User Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-77000

The vulnerability exists in a WordPress plugin designed for social media login. Such plugins are intentionally implemented on public-facing websites to enable user authentication, making the login endpoint accessible to anyone on the internet by design.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a WordPress plugin used for social media logins. It allows unauthorized access to user accounts, including administrative ones, without proper verification of the login process. The primary concern is confirming whether this type of plugin is in use and if it is exposed.

Unverified social logins grant unauthorized account access.
Affects plugins enabling social media user sign-ins.
Confirm plugin use and exposure; assess operational risk.

Attack Path

How an attacker could exploit the issue

An attacker can log into a WordPress site without needing an account by leveraging a flaw in the social login feature. The attacker provides a target user's email address, and the plugin incorrectly assumes the social login was legitimate, granting the attacker access as that user. This could lead to full control of the website.

No authentication needed.
Supply any user's email.
Full site administrator access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to impersonate any user on a WordPress site, including administrators. This is possible because the plugin may not confirm successful social login with the identity provider before granting access, provided the attacker knows the target user's email address.

User accounts, including administrators.
By submitting a user's email address.
Unauthorized site access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

In most organizations, the platform or web application team responsible for maintaining WordPress instances and their plugins would likely own this issue. The first practical step is to identify all WordPress sites using this plugin, determine their exposure, and confirm the business criticality of affected accounts to prioritize remediation.

Platform or application owners should manage this.
Verify plugin usage and site exposure.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP Social Media Login WordPress plugin?

This software component is a WordPress plugin designed to streamline the user registration and login experience by allowing visitors to authenticate using existing credentials from third-party social media platforms. By integrating with these identity providers, it avoids the need for users to create separate site-specific usernames and passwords.

How does CWE-287 apply to CVE-2026-77000?

CWE-287 is the weakness class for Improper Authentication. In the context of this CVE, the plugin fails to perform a secondary verification step to confirm that a social media provider actually authenticated the user. Because this check is missing, the system blindly trusts login requests, allowing unauthorized parties to bypass identity validation entirely.

Do I need to be logged in to trigger this vulnerability?

No. The vulnerability can be triggered by an unauthenticated attacker who does not have an account on the site. The flaw does not rely on active sessions; it is triggered by simply submitting a target user's email address to the plugin's login endpoint. Providing an existing user's email is all that is required to force the system to grant access.

Why is this CVE considered an external threat?

According to Halo Surface Signal, this plugin is designed for public-facing websites to handle user logins, meaning its functionality is inherently accessible from the internet. Because the login endpoint must be exposed for the plugin to work, an attacker anywhere on the web can attempt to exploit this authentication flaw without needing internal network access.

What should I do if I run this plugin?

Your immediate priority is to locate all instances of the WP Social Media Login plugin within your environment. Once identified, evaluate the risk based on the criticality of your WordPress site and its user accounts. Consult with your platform or web application team to coordinate disabling the affected feature or updating the plugin to a version where this verification flaw is resolved.

References

wpscan.com/vulnerability/3051dece-7ecb-4911-bf13-291ebdc34bff/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.