CVE-2026-103898— Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback

Quick assessment

Affected

roxnor Wp Social Login and Register Social Counter

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"Wp Social Login and Register Social Counter"在所有 3.2.2 及更早版本中存在身份验证绕过漏洞。该漏洞源于在注册的社交登录 REST 回调函数中，被设置为，导致系统仅依据 OAuth 提供商返回的电子邮件字符串来定位现有的 WordPress 账户，并在未进行密码验证的情况下直接调用建立会话。而唯一的验证防护机制——即中的检查——对于插件捆绑的 Hybridauth Facebook 和 Twitter 适配器而言实际无效，因为这两

CVSS 8.1 · High EPSS 0.44% · P38 Updated Nov 01, 2026

Possible ATT&CK Techniques 2 AI

T1078.004 · Cloud Accounts T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
roxnor	Wp Social Login and Register Social Counter	`≤ 3.2.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback

Source: CVE Program / CVE List V5

Vulnerability Description

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` with `permission_callback => __return_true` locating an existing WordPress account solely by the email string returned from the OAuth provider and calling `wp_set_auth_cookie()` without a password check, while the only verification guard — `!empty($getProfile->emailVerified)` in `inc/admin-create-user.php` — is a no-op for the bundled Hybridauth Facebook and Twitter adapters, both of which assign the raw email string rather than a boolean verified flag to `emailVerified`. This makes it possible for unauthenticated attackers to obtain a fully authenticated session as any existing WordPress user, including Administrators, whose registered email address can be presented through a configured Facebook or Twitter login on the target site. Exploitation requires only that the attacker control an OAuth account whose provider-returned email matches the target account's registered WordPress email address; no local credentials, nonce, or prior foothold is needed.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

认证机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
roxnor	Wp Social Login and Register Social Counter	0 ~ 3.2.2	-

II. Public POCs for CVE-2026-103898

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-103898

请登录查看更多情报信息。

Other References for CVE-2026-103898 (8)

https://www.cve.org/CVERecord?id=CVE-2026-103898

IV. Related Vulnerabilities

Same product: Wp Social Login and Register Social Counter

Same vendor: roxnor

Same weakness: CWE-287