WordPress Social Login Plugin Authentication Bypass via OAuth

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` with `permission_callback => __return_true` locating an existing WordPress account solely by the email string returned from the OAuth provider and calling `wp_set_auth_cookie()` without a password check, while the only verification guard — `!empty($getProfile->emailVerified)` in `inc/admin-create-user.php` — is a no-op for the bundled Hybridauth Facebook and Twitter adapters, both of which assign the raw email string rather than a boolean verified flag to `emailVerified`. This makes it possible for unauthenticated attackers to obtain a fully authenticated session as any existing WordPress user, including Administrators, whose registered email address can be presented through a configured Facebook or Twitter login on the target site

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Wp Social Login and Register Social Counter plugin for WordPress versions up to 3.2.2 contains a critical authentication bypass vulnerability in its REST API endpoint. The vulnerability stems from improper permission handling and inadequate authentication verification in the OAuth callback mechanism at `/wp-json/wslu-social-login/type/{provider}/`. Rather than validating user credentials through proper authentication channels, the plugin accepts any OAuth response, locates an existing WordPress account by email address alone, and directly sets an authenticated session cookie without password verification. This allows attackers to gain unauthorized access to any WordPress account associated with an email address, potentially compromising websites using this plugin and affecting administrators, editors, and other users whose accounts can be hijacked through this mechanism.

Casky's skill set, powered by Claude's extended reasoning across 754 security techniques mapped to MITRE ATT&CK, maps this vulnerability to Tactics TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe detection patterns aligned with T1078 (Valid Accounts) and T1556 (Modify Authentication Process), revealing suspicious REST API calls to the social login endpoint with `permission_callback => __return_true`, abnormal cookie generation without credential validation, and lateral movement attempts post-compromise. The platform's 283 matching skills would correlate indicators such as unauthenticated `/wp-json/wslu-social-login/` requests, rapid account access from different OAuth providers, and session establishment without standard login flows—enabling security teams to identify exploitation attempts and compromised accounts before widespread damage occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-103898.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-103898

Casky has 283 skills that investigate the attack patterns behind CVE-2026-103898. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn