A critical authentication bypass (CVE-2026-8457) has been disclosed in the WooCommerce Social Login plugin, allowing attackers to hijack any WordPress account – administrators included. The vulnerability carries a CVSS score of 9.8, the highest tier for severity, and can be exploited without a password, two-factor code, or any user interaction.

Why the flaw matters to WordPress developers

WooCommerce Social Login, published by WPWeb Elite, lets e-commerce sites let customers sign in with Apple. Because the plugin integrates directly with the WordPress user system, a breach in its authentication flow can compromise the entire site. An attacker who forges an Apple id_token can take over an existing account, giving them full control over the site’s content, orders, and customer data.

The issue is not an isolated typo; it is the third major authentication flaw found in this plugin family within two years. Repeated failures to verify third-party tokens suggest a systemic problem in how the code treats external credentials.

How the bypass works

  1. Apple token handling – When a visitor clicks “Sign in with Apple,” the plugin receives an id_token, a JSON Web Token (JWT) that contains the user’s email and other claims.
  2. Missing signature verification – The plugin decodes the JWT but never checks the cryptographic signature that proves the token was issued by Apple.
  3. No issuer, audience, or expiration checks – It also skips validation of the token’s issuer (who created it), audience (who it is intended for), and expiration time.

Because of these omissions, an attacker can craft a fake JWT that claims any email address they choose. The plugin trusts the decoded email as genuine and creates or logs in the corresponding WordPress user without any proof.

A second problem compounds the risk: the plugin exposes a security nonce – a one-time value used to prevent replay attacks – to unauthenticated visitors. This makes it trivial for an attacker to script the whole process without needing to trigger a legitimate login flow.

Who is at risk

  • Site owners running WooCommerce – Any site that has the plugin installed and enabled for Apple login is vulnerable.
  • Developers and agencies – Those who manage multiple client sites may have dozens of installations exposed.
  • Customers – If an attacker gains admin access, they can read, modify, or delete order data, potentially exposing personal and payment information.

Immediate steps to protect your site

  1. Update to version 2.8.8 – The fix is included in the latest release, available from CodeCanyon. Premium plugins do not receive automatic updates through the WordPress.org repository, so you must download and install the new package manually.
  2. Audit user accounts – Search the WordPress user table for accounts created after August 1, 2026, especially those with administrator privileges.
  3. Review server logs – Look for unusual requests to the plugin’s social-login endpoints, such as repeated hits from the same IP address or calls that contain malformed JWTs.
  4. Temporary mitigation – If you cannot apply the update right away, disable Apple login in the plugin’s settings. This removes the most exploitable vector while you plan the upgrade.

What developers can learn

  • Always verify JWT signatures – Pull the provider’s JSON Web Key Set (JWKS) and validate the token’s cryptographic proof before trusting any claim.
  • Check issuer, audience, and expiration – These fields confirm the token is meant for your site and is still valid.
  • Never expose authentication nonces publicly – Nonces should be generated server-side and sent only to authenticated sessions.
  • Restrict role assignment – Social-login flows should never grant high-privilege roles (like administrator) without additional verification steps.

The vendor’s response

WPWeb Elite has released the patched version.

What to watch next

Takeaway: A single missing signature check turned a convenient “Sign in with Apple” button into a backdoor for full site takeover. Updating the plugin, disabling the vulnerable login method, and tightening token verification are the only reliable defenses until the fix is widely deployed.