Authentication Bypass Vulnerability in Wp Social Login and Register Social Counter Plugin for WordPress

CVE-2026-103898

What is CVE-2026-103898?

The Wp Social Login and Register Social Counter plugin is susceptible to an authentication bypass vulnerability across all versions up to 3.2.2. This issue arises from the social login REST callback registered at /wp-json/wslu-social-login/type/{provider}/, where the permission_callback method always returns true without adequate password checks. Attackers can leverage this vulnerability if they control an OAuth account that provides an email matching that of a registered WordPress user. As a result, unauthenticated malicious users can gain a fully authenticated session as any WordPress user, including those with administrator privileges, making this a significant security concern for website owners.

References