A critical vulnerability in the WooCommerce Social Login WordPress plugin enables unauthenticated attackers to log in as any existing user, including an administrator. The authentication bypass vulnerability is rated 9.8 out of 10 and affects all versions up to and including 2.8.7.
WooCommerce Social Login Plugin
The WooCommerce Social Login plugin enables frictionless one-click login for ecommerce store customers and enables fast checkout using accounts from services such as Facebook, Google, Amazon, PayPal, and Apple.
Unauthenticated Authentication Bypass
This vulnerability is especially concerning because attackers do not need to acquire any user permission role to exploit it.
The vulnerability affects the plugin’s Apple login handler, which processes the information received when someone signs in with an Apple account.
Apple provides an identity token containing information about the person attempting to log in. The token is protected by a digital signature that should be checked against Apple’s public keys to confirm that it is authentic. This is where the plugin fails, enabling attackers to provide the email address of an existing user and gain access to that account.
According to Wordfence:
“This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying a forged id_token whose payload contains the target user’s email address, as that email is used without any role exclusion to resolve a WordPress account and immediately issue an authenticated session for it.”
Because administrator accounts are not excluded from this exploit, a successful attack could provide administrative access to the WooCommerce site that uses this plugin.
The vulnerability was assigned the Common Vulnerabilities and Exposures identifier CVE-2026-8457 and publicly disclosed on August 1, 2026.
Wordfence recommends that users of versions up to and including 2.8.7 should update to version 2.8.8 or higher version.
Featured Image by Shutterstock/file404
