THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-16261 — The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's passwo

[NVD] CVE-2026-16261 — The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's passwo

mednvdPublished 2026-08-02

CVE-2026-16261 CVSS: None Published: 2026-08-02T06:16:39.450

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as any existing account, including administr

Indicators of compromise

CVE-2026-16261cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-16261