Unauthenticated CSRF in Heateor Social Login

Executive Summary

CVE-2026-57751 is a Cross Site Request Forgery (CSRF) vulnerability in the WordPress Heateor Social Login Plugin versions 1.1.39 and below.

This vulnerability allows malicious actors to trick higher privileged users into executing unwanted actions while authenticated, by making them click a malicious link or submit a form.

It is classified under OWASP Top 10 A1: Broken Access Control and has a CVSS score of 8.1, indicating a high impact on confidentiality and integrity.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to perform unauthorized actions on your website with the privileges of a logged-in user.

Since it affects higher privileged users, attackers could potentially change settings, access sensitive information, or manipulate the site in harmful ways.

However, exploitation requires user interaction, such as clicking a malicious link, and the vulnerability is considered low priority and unlikely to be exploited in mass campaigns.

Useful 0 Not Useful 0

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users are advised to update the Heateor Social Login plugin to a version higher than 1.1.39 if available.

If no official patch is available, seek assistance from your hosting provider or web developer to implement appropriate security measures.

Be cautious of user interactions such as clicking malicious links or submitting forms, as exploitation requires such actions.

Useful 0 Not Useful 0