Authentication Bypass in WooCommerce - Social Login Plugin for WordPress

CVE-2026-8457

What is CVE-2026-8457?

The WooCommerce - Social Login plugin for WordPress is susceptible to an authentication bypass vulnerability due to its Apple login handler. This issue arises because the plugin accepts the Apple id_token and decodes the base64 payload without adequately verifying the JWT signature using Apple's public keys. Furthermore, there is insufficient validation of the issuer, audience, and expiry claims. The security nonce, crucial for initiating the login process, is exposed to unauthenticated visitors through a JavaScript object on the login page. Consequently, this flaw allows attackers to log in as any existing WordPress user, including those with administrative privileges, by presenting a fabricated id_token that contains the target user's email address, facilitating unauthorized access.

References