THREAT OPS › Threat News › [NVD] CVE-2026-77000 — The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplyin
[NVD] CVE-2026-77000 — The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplyin
CVE-2026-77000 CVSS: None Published: 2026-08-22T06:16:17.150
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.
MITRE ATT&CK techniques
- Social MediaT1593.001
Indicators of compromise
- CVE-2026-77000cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-77000