A 9.8 Severity WordPress Plugin Bug That Lets Anyone Become Admin

2026-08-04 — marketing audit SME India

I watched a client's customer success team talk about their login flow last week. They were proud of how smooth it was—Apple login, Google, all of it frictionless. One of them mentioned they use WooCommerce Social Login. That conversation ended badly for them about five minutes ago when Wordfence disclosed a critical vulnerability in that exact plugin.

The bug is rated 9.8 out of 10, which is as close to "your site is compromised" as you can get without someone actually breaking in yet.

What's actually broken here

The plugin handles login via Apple. Apple sends something called an id_token—basically a digital ID card saying "this person is real and they are who they claim to be." The token is signed. It has a signature on it, cryptographically protected, like a notarized document. The plugin was supposed to verify that signature. It doesn't. Actually, that's not quite right—it decodes the token but skips the entire verification step.

More than that, though. The plugin also exposes the nonce needed to trigger the login flow to unauthenticated users via JavaScript. So an attacker can forge a token, use the exposed nonce, and supply any email address they want.

If you run WooCommerce Social Login versions up to 2.8.7, an attacker can log in as you. As an administrator. Without touching a password. Without any user interaction on your end.

Why this isn't a narrow problem

Most authentication vulnerabilities have some friction. Maybe they need a user to click a link, or they can only target non-admin accounts, or they require some credential you might not have. Not this one.

There's no role exclusion on the exploit. Administrator accounts are available. No user needs to do anything. The attacker just forges a token with an admin email and immediately gets a session.

The vulnerability was assigned CVE-2026-8457 and disclosed publicly August 1st. That's recent enough that some shops probably haven't patched yet.

The actual fix

Update to version 2.8.8 or higher. That's it. The fix isn't some elaborate workaround. They added token verification. Which should have been there from the start, but here we are.

If you're running this plugin and you haven't updated, do it today. Not next week. Today.