CVE-2026-77000: WP Social Media Login Auth Bypass Flaw

CVE-2026-77000 Overview

CVE-2026-77000 is an authentication bypass vulnerability in the WP Social Media Login WordPress plugin through version 1.0.6. The plugin fails to verify that a social login was actually completed with the identity provider before authenticating a visitor. An unauthenticated attacker can log in as any existing WordPress user, including administrators, by supplying only that user's email address. The flaw is classified under CWE-287: Improper Authentication.

Critical Impact
Unauthenticated attackers can impersonate any WordPress user, including administrators, leading to full site takeover.

Affected Products

WP Social Media Login WordPress plugin, all versions through 1.0.6

Discovery Timeline

2026-08-22 - CVE-2026-77000 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77000

Vulnerability Analysis

The WP Social Media Login plugin implements social login flows that delegate identity verification to third-party providers. The authentication handler accepts a user-supplied email address and issues a WordPress session for the matching account. The plugin does not confirm that the identity provider actually asserted ownership of that email through a valid Open Authorization (OAuth) exchange or signed token.

Because WordPress email addresses are commonly public or easily enumerated, an attacker who knows an administrator's email can request an authenticated session without credentials, tokens, or user interaction. This is a complete pre-authentication compromise of the site's authorization boundary.

Root Cause

The root cause is missing verification of the identity provider's response. The plugin trusts client-controlled input to identify the authenticating user rather than validating a cryptographically signed assertion from the provider. This pattern maps directly to CWE-287: Improper Authentication.

Attack Vector

The attack is remote and unauthenticated over the network. An attacker sends a crafted request to the plugin's social login endpoint containing the target account's email address. The plugin returns a valid authenticated session for that account. No user interaction, phishing, or provider-side compromise is required.

No verified proof-of-concept code is publicly listed. See the WPScan Vulnerability Report for advisory details.

Detection Methods for CVE-2026-77000

Indicators of Compromise

Successful WordPress login events for administrator accounts without a preceding valid OAuth callback from the configured identity provider.
New administrator accounts, plugin installations, or theme edits following unexpected social-login sessions.
Access log entries hitting the plugin's social login callback endpoint with attacker-controlled email parameters.

Detection Strategies

Correlate WordPress wp_login events with identity provider audit logs and alert when a session is issued without a matching provider assertion.
Alert on administrator logins originating from IP addresses or user agents not previously associated with the account.
Monitor the WordPress wp_users and wp_usermeta tables for unexpected role escalations after plugin activity.

Monitoring Recommendations

Enable verbose authentication logging in WordPress and forward events to a centralized SIEM.
Track HTTP requests to the WP Social Media Login callback URI and baseline expected parameters.
Review file integrity for wp-content/plugins, wp-content/themes, and uploaded PHP files after any suspicious session.

How to Mitigate CVE-2026-77000

Immediate Actions Required

Deactivate and remove the WP Social Media Login plugin on any site running version 1.0.6 or earlier until a fixed release is confirmed.
Force a global password reset and invalidate all active WordPress sessions for administrator and privileged accounts.
Audit administrator accounts, scheduled tasks, and plugin/theme files for signs of unauthorized modification.

Patch Information

No vendor-supplied patched version is referenced in the advisory data at the time of publication. Refer to the WPScan Vulnerability Report for updates on a fixed release.

Workarounds

Remove the plugin entirely and rely on WordPress native authentication or a maintained social-login alternative that validates provider tokens.
Restrict access to /wp-login.php and the plugin's social-login endpoints using a web application firewall (WAF) rule or IP allowlist.
Enforce multi-factor authentication (MFA) for administrator accounts through a separate, unaffected plugin so that email-based impersonation alone cannot yield full access.

bash

# Configuration example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate wp-social-media-login
wp plugin delete wp-social-media-login
wp user session destroy --all