Mohamed Khater

**Name of the Vulnerable Software and Affected Versions** WPCOM Member versions prior to 1.7.28 **Description** An authentication bypass exists in the social-login callback handler registered on the `init` hook. The `login` function fails to perform nonce validation, OAuth state verification, and per-visitor namespace isolation in the session store. An unauthenticated attacker can send a crafted GET request using the `uuid` and `code` parameters to write a forged entry into the global session namespace. Subsequently, a second GET request triggering the `weapp new user()` function can read this entry and resolve an attacker-supplied `openid` value to a bound WordPress account, allowing the attacker to establish an authenticated session via `wp set auth cookie()`. This allows access to any account, including administrators, provided the target site has a social provider configured and the attacker knows the victim's bound openid or unionid. **Recommendations** Update the plugin to a version newer than 1.7.27. As a temporary mitigation, disable the social-login provider configuration to deactivate the vulnerable handler.