CVE-2026-104803

Name of the Vulnerable Software and Affected Versions WPCOM Member versions prior to 1.7.28

Description An authentication bypass exists in the social-login callback handler registered on the init hook. The login function fails to perform nonce validation, OAuth state verification, and per-visitor namespace isolation in the session store. An unauthenticated attacker can send a crafted GET request using the uuid and code parameters to write a forged entry into the global session namespace. Subsequently, a second GET request triggering the weapp new user() function can read this entry and resolve an attacker-supplied openid value to a bound WordPress account, allowing the attacker to establish an authenticated session via wp set auth cookie(). This allows access to any account, including administrators, provided the target site has a social provider configured and the attacker knows the victim's bound openid or unionid.

Recommendations Update the plugin to a version newer than 1.7.27. As a temporary mitigation, disable the social-login provider configuration to deactivate the vulnerable handler.