CVE-2026-103898

Name of the Vulnerable Software and Affected Versions Wp Social Login and Register Social Counter versions prior to 3.2.3

Description An authentication bypass exists due to the social login REST callback registered at the endpoint /wp-json/wslu-social-login/type/{provider}/ using permission callback => return true. The system identifies existing WordPress accounts based solely on the email string provided by the OAuth provider and executes wp set auth cookie() without verifying a password. The verification check !empty($getProfile->emailVerified) in inc/admin-create-user.php fails to function correctly for the bundled Hybridauth Facebook and Twitter adapters, as these adapters assign the raw email string instead of a boolean verified flag to the emailVerified variable. This allows an unauthenticated attacker to gain a fully authenticated session as any user, including Administrators, provided they control an OAuth account with an email address matching the target WordPress account.

Recommendations Update the plugin to a version newer than 3.2.2. As a temporary mitigation, restrict access to the /wp-json/wslu-social-login/type/{provider}/ endpoint.