CVE-2026-103898

Summary

An authentication bypass vulnerability affects the Wp Social Login and Register Social Counter plugin for WordPress. Unauthenticated attackers can gain full access to any WordPress account, including administrator accounts. The vulnerability is patched in version 3.2.3. There is no evidence of active exploitation.

Affected and patched versions

• Wp Social Login and Register Social Counter (plugin wp-social): affected 3.2.2 and earlier; fixed in 3.2.3

Is my site vulnerable?

To determine if your WordPress site uses a vulnerable version of the Wp Social Login and Register Social Counter plugin, you can check the installed plugin version through several methods.

Method 1: WordPress Admin Dashboard

1. Log in to your WordPress administration area.

2. Navigate to the "Plugins" menu, then select "Installed Plugins".

3. Locate "Wp Social Login and Register Social Counter" in the list of installed plugins.

4. The version number is displayed next to the plugin name. If the version is 3.2.2 or earlier, your site is vulnerable.

Method 2: Via FTP/SFTP

1. Connect to your site's server using an FTP or SFTP client.

2. Navigate to the wp-content/plugins/wp-social/ directory.

3. Open the wp-social.php file or the readme.txt file within this directory.

4. Search for a line that begins with "Version:". The number following this indicates the plugin version. If this version is 3.2.2 or earlier, your site is vulnerable.

Method 3: Using WP-CLI (WordPress Command Line Interface)

1. Access your server's command line interface.

2. Navigate to your WordPress installation directory.

3. Execute the following command: wp plugin get wp-social --field=version

4. The output will display the installed version number. If the version is 3.2.2 or earlier, your site is vulnerable.

If your site is running any version of the Wp Social Login and Register Social Counter plugin up to and including 3.2.2, it is exposed to this authentication bypass vulnerability.

What an attacker actually does

The Wp Social Login and Register Social Counter plugin contains an authentication bypass vulnerability that allows an unauthenticated attacker to gain full administrative access to a WordPress site. This vulnerability stems from how the plugin handles social login requests through its REST API callback.

The plugin's social login function is configured to always permit access to its callback, effectively bypassing an initial permission check. When a user attempts to log in through a social provider such as Facebook or Twitter, the plugin requests an email address from that provider. The vulnerability arises because the plugin then searches for an existing WordPress user account that matches this email address. If a match is found, the plugin proceeds to create a fully authenticated session for that WordPress user without requiring any password verification. This process is further complicated by how the plugin handles email verification from social providers. For certain bundled adapters, specifically those for Facebook and Twitter, the plugin receives the raw email string from the social provider but does not effectively check if that email address has been verified by the social provider itself. Instead of a clear "verified" flag, the presence of an email string is treated as sufficient for authentication.

This design flaw means an attacker can create a social media account using an email address that corresponds to an existing WordPress user on the target site. By then attempting to log in to the WordPress site using this attacker-controlled social media account, the plugin's flawed logic takes over. It identifies the matching email, bypasses the password requirement due to the lack of proper verification, and grants the attacker a fully authenticated session. This allows the attacker to gain complete control over the corresponding WordPress account, including accounts with administrative privileges. The severity of this vulnerability is reflected in its CVSS 3.1 base score of 8.1 (High), with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates that an unauthenticated attacker can achieve high confidentiality, integrity, and availability impact over a network, with high attack complexity but no user interaction required.

How to detect a compromise

Detecting a compromise related to this authentication bypass vulnerability involves reviewing user activity and system logs for unusual or unauthorized actions. Since the vulnerability grants full access to existing user accounts, indicators of compromise will often resemble legitimate user activity, but with an unexpected origin or context.

Review WordPress User Activity Logs:

• Unusual Logins: Look for login events from existing user accounts, particularly administrator accounts, that occur at unusual times, from unexpected IP addresses, or through social login methods if those accounts typically use standard username/password authentication.

• New User Accounts: Check for any newly created user accounts, especially those with administrative privileges, that were not authorized.

• User Profile Changes: Examine changes to existing user profiles, such as altered email addresses, passwords, or roles, particularly for high-privilege accounts.

• Unexpected Content Modifications: Look for unauthorized changes to posts, pages, themes, or plugin settings, which could indicate an attacker has gained access and is manipulating the site.

Examine Server Access Logs:

• Social Login Endpoint Access: Review server access logs for repeated or suspicious access attempts to the social login REST API endpoint, typically found at /wp-json/wp-social/v1/social-login-callback. Look for a pattern of multiple attempts followed by successful logins for different users, which could suggest an attacker is attempting to enumerate or gain access to various accounts.

• Unusual POST Requests: Investigate unusual POST requests directed at social login related endpoints that result in successful authentication for accounts that did not initiate the login.

Inspect WordPress Database and Files:

• Database Changes: If you suspect a compromise, review the wp_users and wp_usermeta tables in your WordPress database for any unexpected entries or modifications to user data.

• File Integrity: Check for unauthorized modifications to WordPress core files, plugin files (especially those within wp-content/plugins/wp-social/), or theme files. Tools that monitor file integrity can assist with this.

Using WP-CLI for Inspection: If you have WP-CLI access, you can use commands to inspect user accounts:

• To list all users: wp user list --field=user_login

• To get details for a specific user: wp user get <username> (replace <username> with the actual username).

• To list user metadata, which might reveal unusual social login links or other anomalies: wp user meta list <user_id> (replace <user_id> with the numerical ID of the user).

Any unexplained administrative actions, new users, or unusual login patterns should be investigated as potential indicators of a compromise via this vulnerability.

How to fix

To address the authentication bypass vulnerability in the Wp Social Login and Register Social Counter plugin, follow these steps:

1. Update the Wp Social Login and Register Social Counter plugin to version 3.2.3 or newer. This version contains the necessary patch to resolve the vulnerability.

   • You can update the plugin directly from your WordPress admin dashboard by navigating to "Plugins" -> "Installed Plugins" and clicking "Update Now" next to the Wp Social Login and Register Social Counter plugin.

   • Alternatively, you can manually update by downloading the latest version from the WordPress plugin repository, deactivating and deleting the old plugin version, and then uploading and activating the new version. Ensure you back up your site before performing manual updates.

After updating, it is advisable to review your site for any signs of compromise that may have occurred before the patch was applied. This includes checking user accounts, roles, and recent activity logs for unauthorized changes.

Timeline

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-103898

• https://www.wordfence.com/threat-intel/vulnerabilities/id/e961d3db-da5e-4bde-ae7e-04e6ba3ebef4

• https://wordpress.org/plugins/wp-social/