WordPress Login Social Plugin Allows Unauthenticated Account Takeover

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as any existing account, including administrators, and take over the site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The login-social WordPress plugin versions through 1.0.4 suffer from critical authentication bypass vulnerabilities stemming from insufficient validation of password-reset requests and unverified third-party sign-in data. This flaw allows unauthenticated attackers to reset passwords for any user account—including administrators—or directly assume the identity of existing accounts without providing legitimate credentials. WordPress site owners using this plugin face immediate and severe risk of complete site compromise, as attackers can establish persistence, modify content, exfiltrate data, or deploy malware with full administrative privileges.

Casky's skill framework, leveraging Claude AI with extended reasoning across 754 security skills mapped to MITRE ATT&CK, detects the attack patterns behind this vulnerability through techniques spanning Initial Access and Credential Access (TA0004, TA0006). Practitioners using Casky would observe findings related to CWE-287 (Improper Authentication) manifesting as: unusual password-reset requests lacking proper verification chains, authentication sessions spawning from unexpected third-party sources without identity validation, and administrative account logins originating from non-standard authentication flows. The platform's skills would flag anomalous patterns in authentication logs where users gain elevated privileges without corresponding legitimate sign-in events, suspicious password-reset token generation without proper ownership verification, and account access correlating with external OAuth/social login integrations rather than native credentials—enabling practitioners to identify compromise attempts before successful takeover occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16261.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-16261

Casky has 283 skills that investigate the attack patterns behind CVE-2026-16261. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn