Defenders should note that the security nonce required to initiate the login flow is exposed to unauthenticated users within a localized JavaScript object on the login page. By combining the known nonce with a crafted id_token containing a target victim's email address, an attacker can coerce the application into resolving the target account and establishing an active, authenticated session. This allows for full account takeover of any registered WordPress user, including those with administrative privileges, without requiring existing credentials.

Impact

Successful exploitation allows unauthenticated attackers to gain unauthorized administrative access to affected WordPress installations. This leads to complete site compromise, data exfiltration, the ability to modify or delete content, and the potential for further server-side code execution via administrative plugin or theme management features. The vulnerability affects all sites running versions 2.8.7 or earlier of the WooCommerce - Social Login plugin.

Recommendation

• Update the WooCommerce - Social Login plugin to the latest available version beyond 2.8.7 immediately.
• Review WordPress access logs for anomalous authentication events or successful logins originating from unusual IP addresses immediately following the identification of the vulnerability.
• Audit user roles and administrative accounts for any unauthorized changes or newly created accounts that may indicate post-exploitation activity.
• If patching is not immediately feasible, disable the Apple social login functionality within the plugin settings to mitigate the primary exploitation vector.