CVE-2026-77000: WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow

Q: Who can exploit this issue?

Any unauthenticated visitor who can submit the Twitter login flow with the email address of an existing user may be able to authenticate as that user. This includes administrator accounts.

Q: What does an attacker need to successfully take over an account?

The attacker needs the email address associated with an existing user account. The vulnerable flow does not require the attacker to have actually completed authentication with the social identity provider.

Q: Which installations are affected?

WP Social Media Login versions through 1.0.6 are affected. The provided information does not identify any configuration prerequisite beyond use of the plugin's Twitter login flow.

Published Aug 22, 2026

Updated

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.

Affected Software

1 affected component

WordPress plugin WP Social Media Login<=1.0.6

Event History

Aug 22, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated visitor who can submit the Twitter login flow with the email address of an existing user may be able to authenticate as that user. This includes administrator accounts.

What does an attacker need to successfully take over an account?

The attacker needs the email address associated with an existing user account. The vulnerable flow does not require the attacker to have actually completed authentication with the social identity provider.

Which installations are affected?

WP Social Media Login versions through 1.0.6 are affected. The provided information does not identify any configuration prerequisite beyond use of the plugin's Twitter login flow.