A critical authentication bypass in the WooCommerce – Social Login WordPress plugin (versions up to and including 2.8.7) allows unauthenticated attackers to sign in as any existing user, including administrators, by forging an Apple id_token.
What Is It
The plugin's Apple login handler accepts an Apple id_token and decodes only its base64 payload. It never verifies the JWT signature against Apple's public keys, and it never validates the issuer, audience, or expiry claims. Compounding this, the security nonce required to invoke the login flow is publicly exposed to unauthenticated users through a localized JavaScript object on the login page.
The result: an attacker crafts a token whose payload contains a target user's email address. The plugin uses that email to resolve a WordPress account, with no role exclusion, and immediately issues an authenticated session for it. Classified as CWE-289 (Authentication Bypass by Alternate Name).
Why It Matters
CVSS 3.1 base score is 9.8 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability.
Administrator email addresses on WordPress sites are frequently trivial to guess or discover. Because there is no role exclusion, an admin account is as reachable as any subscriber. Full site takeover follows directly from a successful login.
CVE-2026-8457 does not appear in CISA's Known Exploited Vulnerabilities catalog, so there is no confirmed active exploitation and no KEV-mandated remediation deadline.
What's Vulnerable
- Vendor: WPWeb
- Product: WooCommerce – Social Login (WordPress plugin)
- Affected versions: all versions
<= 2.8.7 - Status of other versions: unaffected by default per the vendor-supplied data
Sites are exposed only where the plugin is installed and the Apple login flow is available.
Patch Status
The NVD record for CVE-2026-8457 lists no fixed version and no patched release. CVE status is Received, with the record sourced from Wordfence. Until a fixed version is confirmed by the vendor, disabling the plugin, or at minimum the Apple login provider, is the only mitigation the published advisories support. No required-action or due-date guidance applies, as there is no KEV entry.
Sources
- NVD, CVE-2026-8457: https://nvd.nist.gov/vuln/detail/CVE-2026-8457
- Wordfence Threat Intelligence: https://www.wordfence.com/threat-intel/vulnerabilities/id/53e83037-2cc5-4dc9-b55d-03829df12a65?source=cve
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CodeCanyon; Social Login WordPress/WooCommerce Plugin: https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883