Live › vulnerability › CVE-2026-103898
The Wp Social Login and Register Social Counter WordPress plugin up to version 3.2.2 trusts the email address returned by a Facebook or Twitter login without verifying it. An attacker who controls an OAuth account with the same email as a WordPress user, including an Administrator, gets a fully authenticated session as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 08:34 UTC. All times on this page are UTC.
Sites running the plugin at version 3.2.2 or earlier with Facebook or Twitter social login configured are exposed, since the login callback accepts any OAuth email that matches a WordPress account. Sites without the plugin, or with it disabled or without those providers configured, are not affected by this description; the sources do not say whether other providers are affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| wp-social | wordpress | <= 3.2.2 | 3.2.3 |
Wp Social Login and Register Social Counter (folder wp-social); versions <= 3.2.2 are affectedUpdate the Wp Social Login and Register Social Counter plugin (slug wp-social) to 3.2.3 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at /wp-json/wslu-social-login/type/{provider}/ with permission_callback => __return_true locating an existing WordPress account solely by the email string returned from the OAuth provider and calling wp_set_auth_cookie() without a password check, while the only verification guard — !empty($getProfile->emailVerified) in inc/admin-create-user.php — is a no-op for the bundled Hybridauth Facebook and Twitter adapters, both of which assign the raw email string rather than a boolean verified flag to emailVerified. This makes it possible for unauthenticated attackers to obtain a fully authenticated session as any existing WordPress user, including Administrators, whose registered email address can be presented through a configured Facebook or Twitter login on the target site. Exploitation requires only that the attacker control an OAuth account whose provider-returned email matches the target account's registered WordPress email address; no local credentials, nonce, or prior foothold is needed.
This page as .md · .json · in your agent: get_signal("CVE-2026-103898")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.