CVE-2026-77000
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.
Risk Assessment
The vulnerability may allow an unauthenticated attacker to fully take over an administrator account, leading to complete compromise of the WordPress site.
Recommendation
It is recommended to immediately update the plugin to a patched version or remove it if not essential.
Original NVD description (English source)
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.