WordPress Social Login Plugin Fails Identity Verification

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP Social Media Login plugin through version 1.0.6 contains a critical authentication bypass vulnerability (CWE-287) that allows unauthenticated attackers to impersonate any user by simply providing their email address during the login process. The plugin fails to verify that social login was actually completed with the identity provider before granting authentication, effectively short-circuiting the entire OAuth/social login verification chain. This affects any WordPress installation using the vulnerable plugin, with particular risk for sites where attackers can target administrative accounts. The CVSS 9.8 critical rating reflects the severity: complete account takeover without credentials, no user interaction required, and network-accessible exploitation.

Casky's 283 mapped skills detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Using Claude AI with extended reasoning, practitioners would identify detection opportunities in several areas: anomalous authentication logs showing successful logins without corresponding social identity provider session records, unusual account access patterns where admin accounts suddenly authenticate from new locations without prior social login attempts, and authentication flow analysis revealing requests that skip provider verification callbacks. Security teams reviewing findings would see skill coverage spanning OAuth/OIDC bypass patterns, authentication logic flaws, and privilege escalation through compromised administrative accounts—enabling proactive threat hunting for exploitation attempts and rapid incident response if the vulnerability was leveraged.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-77000.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-77000

Casky has 283 skills that investigate the attack patterns behind CVE-2026-77000. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn