A security flaw has been found in the WooCommerce Social Login plugin for WordPress, affecting all versions up to and including 2.8.7. The issue is in the plugin's Apple login feature: it fails to properly verify that login tokens from Apple are legitimate, and a security code meant to protect the login process is publicly visible to anyone who visits your site's login page.
This flaw lets unauthenticated attackers (people who do not have an existing account on your site) create fake Apple login tokens to access any existing WordPress user account on your site, including administrator accounts. Attackers can do this by submitting a forged token that includes the target user's email address: the plugin uses that email to find the matching WordPress account and grants the attacker an active, logged-in session for that account immediately, with no restrictions on which user roles can be targeted.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-8457
