CVE-2026-77000 — WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, a…
Published: 2026-08-22 · CVSS: 9.8 · CVSS 3.1
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7