CVE-2026-77001

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/01c78c78-3915-44da-824a-f68074985c75/

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress Social Login & Sharing buttons with Analytics By SoClever hasta la versión 1.2.0 no realiza ninguna autenticación, autorización o comprobación de nonce en uno de sus manejadores de inicio de sesión de acceso público, permitiendo a atacantes no autenticados obtener una sesión válida como cualquier usuario existente, incluidos los administradores. En el caso predeterminado, se obtiene una sesión como la cuenta de administrador original del sitio sin necesidad de conocer ningún detalle de la cuenta en absoluto.

Information

Published : 2026-08-22 06:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-77001

Mitre link : CVE-2026-77001

CVE.ORG link : CVE-2026-77001

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-77001", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77001", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-23T15:25:52.772051Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "Social Login & Sharing buttons with Analytics By SoClever", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2.0"}], "defaultStatus": "unknown"}]}], "published": "2026-08-22T06:16:17.323", "references": [{"url": "https://wpscan.com/vulnerability/01c78c78-3915-44da-824a-f68074985c75/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all."}, {"lang": "es", "value": "El plugin de WordPress Social Login & Sharing buttons with Analytics By SoClever hasta la versi\u00f3n 1.2.0 no realiza ninguna autenticaci\u00f3n, autorizaci\u00f3n o comprobaci\u00f3n de nonce en uno de sus manejadores de inicio de sesi\u00f3n de acceso p\u00fablico, permitiendo a atacantes no autenticados obtener una sesi\u00f3n v\u00e1lida como cualquier usuario existente, incluidos los administradores. En el caso predeterminado, se obtiene una sesi\u00f3n como la cuenta de administrador original del sitio sin necesidad de conocer ning\u00fan detalle de la cuenta en absoluto."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "contact@wpscan.com"}