WooCommerce Social Login Unauthenticated Authentication Bypass via Forged Apple JWT (CVE-2026-8457)

Vulnerability Overview Vulnerability Name: WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT CVE ID: CVE-2026-8457 CVSS Score: 9.8 (Critical) Published Date: August 1, 2026 Last Updated: August 1, 2026 Researcher: Rafie Muhammad - Awesome Motive, Inc. Affected Scope Software Type: Plugin Software Name: WooCommerce - Social Login Affected Versions: <= 2.8.7 Fixed Version: 2.8.8 Remediation Fixed Version: Update to version 2.8.8 or later patched versions Vulnerability Description This vulnerability allows an unauthenticated attacker to bypass authentication by forging an Apple 'id_token' JWT, enabling login as an arbitrary WordPress user, including administrators. By simply providing a forged id_token containing the target user's email address, the attacker can immediately gain access to the corresponding WordPress account and issue a valid authentication session. References codecanyon.net Related Vulnerabilities WooCommerce Social Login <= 2.8.2 - Cross-Site Request Forgery - CVE ID: CVE-2025-99472 - CVSS Score: 4.3 - Researcher: Ananda Dhakal - Date: April 16, 2025 Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider - CVE ID: CVE-2024-10114 - CVSS Score: 8.1 - Researcher: wesley (wcraft) - Date: November 4, 2024 WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover - CVE ID: CVE-2024-7503 - CVSS Score: 9.8 - Researcher: Truc Phan - Date: August 9, 2024 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass - CVE ID: CVE-2024-6635 - CVSS Score: 7.3 - Researcher: Vu Nguyen (maxtv) - Date: July 19, 2024 WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation - CVE ID: CVE-2024-6636 - CVSS Score: 9.8 - Researcher: Vu Nguyen (maxtv) - Date: July 19, 2024 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password - CVE ID: CVE-2024-6637 - CVSS Score: 7.3 - Researcher: Vu Nguyen (maxtv) - Date: July 19, 2024 WooCommerce Social Login <= 2.6.3 - Unauthenticated PHP Object Injection - CVE ID: CVE-2024-37502 - CVSS Score: 9.8 - Researcher: Ananda Dhakal - Date: July 5, 2024 WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness - CVE ID: CVE-2024-5868 - CVSS Score: 6.5 - Researcher: István Márton - Date: June 14, 2024 WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection - CVE ID: CVE-2024-5671 - CVSS Score: 9.8 - Researcher: István Márton - Date: June 14, 2024 Summary This vulnerability allows an unauthenticated attacker to bypass authentication by forging an Apple 'id_token' JWT, affecting the WooCommerce - Social Login plugin versions <= 2.8.7. It is recommended to update to version 2.8.8 or later patched versions to remediate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

WooCommerce Social Login Unauthenticated Authentication Bypass via Forged Apple JWT (CVE-2026-8457)

More from this source