CVE-2026-77001 Overview
CVE-2026-77001 is a critical authentication bypass vulnerability in the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through version 1.2.0. The plugin exposes a publicly accessible login handler that performs no authentication, authorization, or nonce validation. Unauthenticated attackers can obtain a valid session as any existing user, including administrators. In default installations, attackers gain a session as the site's original administrator account without needing to know any credentials. The vulnerability is classified under CWE-287: Improper Authentication.
Critical Impact
Remote unauthenticated attackers can hijack administrator sessions on affected WordPress sites, resulting in full site takeover.
Affected Products
- Social Login & Sharing buttons with Analytics By SoClever WordPress plugin
- All versions through 1.2.0
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2026-08-22 - CVE-2026-77001 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-77001
Vulnerability Analysis
The plugin exposes a login handler over a public endpoint without validating the requestor. The handler skips three standard WordPress security controls: authentication checks, capability or authorization checks, and nonce validation. As a result, any HTTP client can invoke the handler and receive a valid WordPress session cookie for an arbitrary user account.
Because the default target is the site's original administrator account, exploitation requires no prior knowledge of usernames, passwords, or user IDs. The attack completes over the network without user interaction and grants full administrative control of the WordPress site.
Root Cause
The root cause is missing authentication logic in a publicly registered AJAX or REST action. WordPress plugins that expose login functionality must verify a caller's identity before issuing session tokens through wp_set_auth_cookie() or equivalent primitives. This plugin issues session tokens based on request parameters alone, without validating that the caller is entitled to authenticate as the requested user.
Attack Vector
An attacker sends a crafted HTTP request to the vulnerable login handler endpoint exposed by the plugin. The handler returns authentication cookies scoped to the target user. In the default configuration, the attacker does not need to supply any account details and receives cookies for the primary administrator. The attacker then uses the returned cookies to access the WordPress administration dashboard and perform any administrative action, including installing malicious plugins, modifying content, and creating persistent backdoor accounts.
No verified public exploit code is available. Refer to the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-77001
Indicators of Compromise
- Unexpected successful administrator logins from unfamiliar IP addresses without preceding failed login attempts
- New administrator accounts, unfamiliar plugin installations, or modifications to wp-config.php and theme files
- WordPress access logs showing requests to the SoClever plugin's login handler followed immediately by authenticated /wp-admin/ activity
- Presence of the SoClever plugin directory in wp-content/plugins/ at version 1.2.0 or earlier
Detection Strategies
- Inventory WordPress installations and identify sites with the SoClever plugin at version 1.2.0 or earlier
- Review web server logs for POST or GET requests targeting the plugin's admin-ajax.php actions or REST routes tied to social login
- Correlate session cookie issuance events with the originating request path to identify sessions minted by the vulnerable handler
Monitoring Recommendations
- Alert on the creation of new WordPress users with administrator role
- Monitor for outbound requests from WordPress hosts to unfamiliar domains that may indicate post-exploitation callbacks
- Enable and centralize WordPress audit logging to capture authentication events with source IP context
How to Mitigate CVE-2026-77001
Immediate Actions Required
- Deactivate and remove the Social Login & Sharing buttons with Analytics By SoClever plugin from all WordPress sites
- Rotate passwords and invalidate active sessions for all administrator accounts using wp auth revoke or by regenerating WordPress salts in wp-config.php
- Audit user accounts, installed plugins, themes, and scheduled tasks for unauthorized changes
- Restore from a known-good backup if signs of compromise are present
Patch Information
No vendor patch has been referenced in the available advisory data. The WPScan Vulnerability Report indicates the flaw affects the plugin through version 1.2.0. Remove the plugin until the vendor publishes a fixed release.
Workarounds
- Block public access to the plugin's endpoints at the web application firewall (WAF) or reverse proxy layer
- Restrict admin-ajax.php and REST API endpoints tied to the plugin using server-side access controls or IP allowlisting
- Replace the plugin with an alternative social login solution that enforces standard WordPress authentication and nonce checks
# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate soclever-social-login-sharing
wp plugin delete soclever-social-login-sharing
# Invalidate all active sessions by rotating WordPress salts
wp config shuffle-salts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
