Vulnerability · Published Aug 22, 2026 · Assigned by WPScan
CVE-2026-77000WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow
Critical 9.8
In plain English
A critical-severity improper authentication in WP Social Media Login from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 57.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Social Media Login | 0 – through 1.0.6 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/3051dece-7ecb-4911-bf13-291ebdc34bff/ exploit, vdb-entry, technical-description