External risk intelligence

WooCommerce Social Login Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-8457

The vulnerability affects a WordPress plugin designed to provide social login functionality on public-facing websites. Authentication and login portals are inherently exposed to the internet by design to allow user access, making this a service that is publicly reachable in normal deployment scenarios.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a WordPress plugin used for social login, allowing unauthenticated attackers to bypass security measures. By forging a token, attackers can log in as any existing user, including administrators, by using the target user's email address. This could lead to unauthorized access and control over WordPress sites.

Attackers can impersonate any user.
Plugin used for public login access.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can bypass authentication by forging a token for the plugin's Apple login. The plugin's Apple login handler accepts an `id_token` and decodes its payload without verifying its signature or validating critical claims. Because the required security nonce is exposed in JavaScript on the login page, an attacker can create a fake `id_token` containing any user's email address and log in as that user, potentially gaining administrative access.

Publicly accessible login page.
Forged Apple ID token.
Unauthorized administrative access.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could bypass authentication and log in as any existing WordPress user by supplying a forged token. This token's payload is decoded without proper signature verification or validation of critical claims, allowing the attacker to resolve an account using the target user's email address and immediately establish an authenticated session.

WordPress user accounts at risk.
Attackers can forge tokens to bypass login.
Compromised accounts could lead to unauthorized actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WooCommerce - Social Login plugin's authentication bypass vulnerability likely impacts application owners and platform teams responsible for WordPress sites. The first practical step is to identify all WordPress instances using this plugin, confirm their public reachability, and determine the business criticality of any affected sites. Subsequently, accountable owners should be identified to coordinate remediation efforts based on the assessed risk.

Application owners should lead remediation efforts.
Verify plugin usage and public exposure.
Plan maintenance for secure updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WooCommerce - Social Login plugin?

It is a WordPress extension designed to simplify user registration and sign-in processes by integrating third-party identity providers, such as Apple, directly into a website's login workflow. By allowing visitors to authenticate using existing social accounts instead of creating new credentials, it enhances user convenience on e-commerce sites. The plugin manages the handshake between the user and the external service to establish a local site session.

How does CVE-2026-8457 enable authentication bypass?

This vulnerability, classified as CWE-289 (Authentication Bypass by Alternate Name), occurs because the plugin fails to verify the digital signature or security claims of the Apple login token. Since the plugin trusts the token payload without cryptographic proof, it accepts forged data. An attacker can supply a malicious token containing any email address; the plugin then treats this as a valid credential to sign the attacker into the site as that user.

What triggers the vulnerability in this plugin?

The flaw is triggered when an attacker submits a custom-crafted token to the plugin's Apple login handler. Because the plugin also publicly exposes the required security nonce in a JavaScript object on the login page, the attacker has everything needed to initiate the flow. Note that simply visiting the login page does not trigger the bypass; the vulnerability requires the active, manual submission of a forged token payload to the server.

Why should I worry about this if my site is public?

According to Halo Surface Signal, this plugin is inherently designed for public-facing login portals, making its functionality reachable from the internet by default. Because the vulnerability allows unauthenticated access to any user account—including administrators—sites using this plugin face a high risk of total compromise. If your WordPress instance is accessible to the public, the authentication mechanisms provided by this plugin are effectively open to manipulation.

How do I secure my site against this issue?

Begin by auditing your WordPress environment to confirm if the WooCommerce - Social Login plugin is installed and active. Determine which of your sites use this feature, particularly those that are internet-facing. Once you have identified all affected instances, work with your technical team to prioritize these for maintenance. Stay alert for official security updates from the plugin developer that resolve these token validation and nonce exposure flaws.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.