CVE-2026-8457: WooCommerce Social Login Auth Bypass Flaw

CVE-2026-8457 Overview

CVE-2026-8457 is an authentication bypass vulnerability in the WooCommerce - Social Login plugin for WordPress affecting all versions up to and including 2.8.7. The plugin's Apple login handler decodes the base64 payload of the Apple id_token without verifying the JWT signature against Apple's public keys. It also skips validation of the iss, aud, and exp claims. The security nonce required to invoke the login flow is exposed to unauthenticated users through a localized JavaScript object on the login page. Unauthenticated attackers can log in as any existing WordPress user, including administrators, by supplying a forged id_token containing the target user's email.

Critical Impact
Unauthenticated attackers can gain full administrator access to any WordPress site running the vulnerable plugin, leading to complete site compromise.

Affected Products

WooCommerce - Social Login plugin for WordPress
All versions up to and including 2.8.7
WordPress sites using the plugin's Apple login handler

Discovery Timeline

2026-08-02 - CVE-2026-8457 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-8457

Vulnerability Analysis

The vulnerability is classified under CWE-289 (Authentication Bypass by Alternate Name/Path). The plugin's Apple Sign-In implementation treats the Apple id_token as a trusted identity assertion without performing cryptographic verification. Apple issues these tokens as signed JSON Web Tokens (JWTs), and a compliant relying party must validate the signature against Apple's rotating public keys published at Apple's JWKS endpoint.

The plugin decodes only the base64 payload segment of the JWT. It extracts the email claim and uses it to resolve a WordPress account. No role exclusion is applied, so administrator accounts are eligible. The plugin then issues an authenticated session for the resolved user.

Root Cause

Two defects combine to produce the bypass. First, the Apple login handler omits JWT signature verification and skips validation of the iss (issuer), aud (audience), and exp (expiry) claims. Second, the WordPress nonce required to invoke the login AJAX endpoint is emitted to unauthenticated visitors through a localized JavaScript object on the standard login page.

Attack Vector

An unauthenticated attacker fetches the WordPress login page and extracts the localized nonce from the page source. The attacker then constructs a JWT with a header, a payload containing the target administrator's email address in the email claim, and an arbitrary signature. The forged token is submitted to the plugin's Apple login endpoint along with the harvested nonce. The plugin decodes the payload, locates the WordPress user by email, and issues an authenticated session cookie for that account.

The attack requires no user interaction, no privileges, and can be conducted remotely over the network. The only prerequisite is knowledge of a valid administrator email address, which is often discoverable through the WordPress REST API /wp-json/wp/v2/users endpoint or author archive enumeration.

Detection Methods for CVE-2026-8457

Indicators of Compromise

Unexpected successful login events for administrator accounts originating from unfamiliar IP addresses
Requests to the plugin's Apple login AJAX action from clients that did not complete a legitimate Apple OAuth flow
New administrator or editor accounts created shortly after suspicious login events
Modifications to plugin files, theme files, or the wp_options table following anomalous authentication activity

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php with the plugin's Apple login action parameter
Correlate authentication success events with the absence of a preceding OAuth redirect from appleid.apple.com
Alert on JWTs presented to the login endpoint that fail signature verification when replayed against Apple's JWKS
Monitor for enumeration of the WordPress users REST endpoint followed by login attempts referencing the enumerated emails

Monitoring Recommendations

Enable WordPress audit logging to capture user login, session issuance, and role change events
Forward web server and PHP error logs to a centralized SIEM for correlation and retention
Track baseline administrator login patterns and alert on deviations in source geolocation or user agent
Review installed plugin versions across managed WordPress fleets to identify sites running Social Login <= 2.8.7

How to Mitigate CVE-2026-8457

Immediate Actions Required

Deactivate the WooCommerce - Social Login plugin until a patched version is installed
Rotate passwords and invalidate active sessions for all administrator and privileged accounts
Audit user accounts for unauthorized additions, role changes, or email address modifications
Restrict access to /wp-admin/ and admin-ajax.php at the web server or WAF layer where feasible

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Consult the Wordfence Vulnerability Report and the Codecanyon Plugin Listing for vendor updates. Any patched release must verify the Apple id_token signature against Apple's JWKS and validate the iss, aud, and exp claims before trusting the email claim.

Workarounds

Disable the Apple Sign-In provider within the plugin configuration while retaining other social providers
Deploy WAF rules that block requests to the plugin's Apple login AJAX action from untrusted sources
Enforce multi-factor authentication for all administrator accounts through a separate MFA plugin
Disable REST API user enumeration by restricting the /wp-json/wp/v2/users endpoint to authenticated requests

bash

# Example: block the plugin's Apple login AJAX action at the web server
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "wc_social_login_apple") {
        return 403;
    }
}