{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wp-social-login-and-register-social-counter--3.2.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wp_social_login_and_register_social_counter_project:wp_social_login_and_register_social_counter:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-103898"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Wp Social Login and Register Social Counter (\u003c= 3.2.2)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","wordpress","plugin-vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Wp Social Login and Register Social Counter plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-103898) affecting versions 3.2.2 and earlier. The flaw resides in the REST API callback registered at '/wp-json/wslu-social-login/type/{provider}/'. The plugin incorrectly trusts email addresses provided by OAuth providers (specifically Facebook and Twitter adapters) to identify users. Due to a logical failure where the 'emailVerified' check is a no-op, the plugin calls 'wp_set_auth_cookie()' to authenticate the attacker as the account associated with the provided email without requiring a password or additional proof of ownership.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an attacker full access to the target WordPress site as any user, including users with Administrator privileges. This impact is observed based on the logic of the vulnerable REST callback implementation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately disable the Wp Social Login and Register Social Counter plugin until a security update patching this authentication logic is verified and deployed.\u003c/li\u003e\n\u003cli\u003eAudit the WordPress 'users' table and recent login logs for anomalous administrative access from unrecognized IP addresses or timestamps.\u003c/li\u003e\n\u003cli\u003eIf social login functionality is required, migrate to a reputable, actively maintained plugin and enforce strict multi-factor authentication (MFA) for all administrative accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T09:55:04Z","date_published":"2026-10-31T09:55:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-social-login-auth-bypass/","summary":"An authentication bypass vulnerability in the Wp Social Login and Register Social Counter plugin allows unauthenticated attackers to impersonate any site user, including administrators, by spoofing OAuth email callbacks.","title":"Wp Social Login and Register Social Counter: Authentication Bypass (CVE-2026-103898)","url":"https://feed.craftedsignal.io/briefs/2026-10-social-login-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Wp Social Login and Register Social Counter (\u003c= 3.2.2)","version":"https://jsonfeed.org/version/1.1"}