Overview
A critical authentication bypass vulnerability has been disclosed in the WooCommerce - Social Login plugin for WordPress, tracked as CVE-2026-8457 with a CVSS score of 9.8 (Critical). The flaw affects all versions up to and including 2.8.7 and allows unauthenticated attackers to bypass the login process entirely, gaining unauthorized access to any registered WordPress user account.
Vulnerability Details
The vulnerability resides in the plugin's Apple login handler. When a user authenticates via "Sign in with Apple," the plugin receives an id_token from Apple — a JSON Web Token (JWT) that identifies the authenticating user. The flawed implementation decodes only the base64-encoded payload of this JWT without verifying the cryptographic signature against Apple's public keys.
This means an attacker can craft a forged id_token with an arbitrary sub (subject) claim targeting any registered user's Apple ID, submit it to the login endpoint, and the plugin will accept it as legitimate authentication — bypassing password requirements entirely.
Technical Summary
| Field | Details |
|---|---|
| CVE ID | CVE-2026-8457 |
| CVSS Score | 9.8 (Critical) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Impact | High Confidentiality, High Integrity, High Availability |
Affected Products
- WooCommerce - Social Login plugin for WordPress
- All versions ≤ 2.8.7
Impact
An unauthenticated attacker who can reach the WordPress site's login endpoint can:
- Log in as any registered user whose Apple ID is known or guessable
- Gain administrator-level access if the targeted account has elevated privileges
- Access sensitive WooCommerce order data, customer personal information, and stored payment methods
- Pivot to full site compromise if the hijacked account has admin roles
No special knowledge of the target account's password is required — only knowledge of the Apple sub identifier associated with the account, which may be predictable or discoverable.
Recommended Actions
- Update immediately to a patched version of the WooCommerce - Social Login plugin (version 2.8.8 or later once available from the plugin vendor)
- Disable the plugin if an update is not immediately available and Apple login is not essential to site operations
- Audit access logs for suspicious login events via Apple social login, particularly for admin accounts
- Review active sessions and invalidate any suspicious authenticated sessions
- Enable two-factor authentication on all administrator accounts as a compensating control
Background: JWT Signature Verification
JSON Web Tokens issued by identity providers like Apple are cryptographically signed. The correct implementation requires validating the signature using the provider's published public keys (available from Apple's JWKS endpoint). Merely decoding the base64 payload without signature verification means any client can forge any identity claim — a classic and well-documented class of JWT implementation error.
WordPress plugin developers handling social authentication must always verify the full JWT signature chain before trusting any claims contained in the token payload.