Wp Social Login and Register Social Counter: Authentication Bypass (CVE-2026-103898)

The Wp Social Login and Register Social Counter plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-103898) affecting versions 3.2.2 and earlier. The flaw resides in the REST API callback registered at '/wp-json/wslu-social-login/type/{provider}/'. The plugin incorrectly trusts email addresses provided by OAuth providers (specifically Facebook and Twitter adapters) to identify users. Due to a logical failure where the 'emailVerified' check is a no-op, the plugin calls 'wp_set_auth_cookie()' to authenticate the attacker as the account associated with the provided email without requiring a password or additional proof of ownership.

Impact

Successful exploitation grants an attacker full access to the target WordPress site as any user, including users with Administrator privileges. This impact is observed based on the logic of the vulnerable REST callback implementation.

Recommendation

• Immediately disable the Wp Social Login and Register Social Counter plugin until a security update patching this authentication logic is verified and deployed.
• Audit the WordPress 'users' table and recent login logs for anomalous administrative access from unrecognized IP addresses or timestamps.
• If social login functionality is required, migrate to a reputable, actively maintained plugin and enforce strict multi-factor authentication (MFA) for all administrative accounts.