CVE-2026-86814: UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email

Q: What does an attacker need to exploit this issue?

The attacker needs a social login provider account that lets them assert the target user's email address without the provider confirming ownership of that address. No authentication to the target WordPress account is required.

Q: Which accounts are at risk?

Any existing account whose email address an attacker can assert through their own provider account may be exposed. This includes administrator accounts.

Q: What is the remediation?

Update UsersWP - Social Login to version 1.5.10 or later. Versions before 1.5.10 are affected.

Published Sep 19, 2026

Updated

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.

Affected Software

1 affected component

UsersWP UsersWP - Social Login<1.5.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/UsersWP (Social Login) to a version that resolves this vulnerability.
Fixed in 1.5.10

Event History

Sep 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs a social login provider account that lets them assert the target user's email address without the provider confirming ownership of that address. No authentication to the target WordPress account is required.

Which accounts are at risk?

Any existing account whose email address an attacker can assert through their own provider account may be exposed. This includes administrator accounts.

What is the remediation?