CVE-2026-77000

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/3051dece-7ecb-4911-bf13-291ebdc34bff/

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress WP Social Media Login hasta la versión 1.0.6 no verifica que un inicio de sesión social se haya completado realmente con el proveedor de identidad antes de autenticar a un visitante, permitiendo a atacantes no autenticados iniciar sesión como cualquier usuario existente, incluyendo administradores, al proporcionar la dirección de correo electrónico de ese usuario.

Information

Published : 2026-08-22 06:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-77000

Mitre link : CVE-2026-77000

CVE.ORG link : CVE-2026-77000

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-77000", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77000", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-23T15:26:06.918805Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "WP Social Media Login", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.6"}], "defaultStatus": "unknown"}]}], "published": "2026-08-22T06:16:17.150", "references": [{"url": "https://wpscan.com/vulnerability/3051dece-7ecb-4911-bf13-291ebdc34bff/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address."}, {"lang": "es", "value": "El plugin de WordPress WP Social Media Login hasta la versi\u00f3n 1.0.6 no verifica que un inicio de sesi\u00f3n social se haya completado realmente con el proveedor de identidad antes de autenticar a un visitante, permitiendo a atacantes no autenticados iniciar sesi\u00f3n como cualquier usuario existente, incluyendo administradores, al proporcionar la direcci\u00f3n de correo electr\u00f3nico de ese usuario."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "contact@wpscan.com"}