PT-2026-67342 · WordPress · Woocommerce - Social Login
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
WooCommerce - Social Login versions prior to 2.8.8
Description
An authentication bypass exists in the Apple login handler. The issue occurs because the plugin accepts the Apple
id token and decodes only its base64 payload without verifying the JSON Web Token (JWT) signature against Apple's public keys or validating the issuer, audience, or expiry claims. Additionally, the security nonce required to initiate the login flow is publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This allows unauthenticated attackers to gain access to any existing WordPress account, including administrator accounts, by providing a forged id token containing the target user's email address, which is then used to issue an authenticated session without role exclusion.Recommendations
Update to a version newer than 2.8.7.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Woocommerce - Social Login