CVE-2026-8457
Received Received - Intake

Authentication Bypass in WooCommerce Social Login Plugin

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: Wordfence

Description
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined with the security nonce required to invoke the login flow being publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying a forged id_token whose payload contains the target user's email address, as that email is used without any role exclusion to resolve a WordPress account and immediately issue an authenticated session for it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-8457

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce social_login to 2.8.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-289 The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WooCommerce - Social Login plugin for WordPress has an authentication bypass flaw in versions up to 2.8.7. The vulnerability occurs because the plugin's Apple login handler does not verify the JWT signature, issuer, audience, or expiry claims of the Apple id_token. Additionally, the security nonce required for login is exposed to unauthenticated users via a JavaScript object. Attackers can exploit this to forge an id_token containing a target user's email, log in as that user, and gain an authenticated session.

Detection Guidance

Check if the WooCommerce - Social Login plugin version 2.8.7 or lower is installed. Inspect WordPress login pages for exposed nonce values in JavaScript objects. Monitor for unauthorized admin logins or unusual session activity.

Impact Analysis

This vulnerability allows unauthenticated attackers to log in as any WordPress user, including administrators, by forging an Apple id_token. This could lead to unauthorized access to sensitive data, complete control over the WordPress site, and potential takeover of user accounts. The high CVSS score of 9.8 indicates severe impact.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using this plugin may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Update the WooCommerce - Social Login plugin to the latest version. Disable the Apple login handler if not needed. Implement strict JWT validation for id_tokens. Review and revoke unauthorized sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8457. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart