On August 1, 2026, a vulnerability was disclosed in the WooCommerce Social Login plugin that should make every WooCommerce store owner stop what they're doing and check their plugin version. CVE-2026-8457 carries a severity rating of 9.8 out of 10 — near the top of the CVSS scale — and it allows unauthenticated attackers to log into any existing account on a WordPress site, including administrator accounts, without knowing a password.

The plugin, developed by wpweb, enables one-click login through Facebook, Google, Amazon, PayPal, and Apple. It's popular because it removes friction at checkout — customers tap "Sign in with Apple" and they're in. The problem is that the Apple login handler didn't actually verify that Apple issued the identity token it received.

How the exploit works

When someone signs in with Apple, Apple sends back an identity token — a JWT (JSON Web Token) that contains the user's email address and other claims. That token is supposed to be cryptographically verified against Apple's public keys to confirm it's genuine. The WooCommerce Social Login plugin skipped this verification step on the Apple login path.

That means an attacker could craft a fake identity token containing any email address, submit it to the plugin's Apple login endpoint, and the plugin would accept it. If the email matched an existing WordPress user — say, the site administrator — the plugin would issue a fully authenticated session for that account. No password required. No two-factor check. No interaction from the victim.

The attack doesn't require any prior access to the site. No user account, no contributor role, no API key. It's completely unauthenticated. And because administrator accounts aren't excluded from the Apple login resolution, the highest-privilege account on the site is just as vulnerable as a customer who signed up with their Gmail.

Why this is worse than it sounds

A CVSS score of 9.8 usually means the vulnerability is remotely exploitable, requires no authentication, and has high impact across confidentiality, integrity, and availability. This one checks all three boxes.

Once an attacker has admin access to a WooCommerce store, they can do anything the admin can do. Install backdoors. Export customer data — names, addresses, order histories, payment metadata. Redirect payments. Inject malware into the checkout flow. Create new admin accounts for persistent access. The usual catastrophe.

What makes it particularly nasty is the attack surface. Any WooCommerce store running this plugin with Apple login enabled is exposed, and the attacker doesn't need to interact with the target at all. There's no phishing email to send, no malicious link to click. The vulnerability is in the server-side token handling, so it's invisible to the site owner until something goes wrong.

The fix

The vulnerability was patched in version 2.8.8, released in early August. If you're running WooCommerce Social Login version 2.8.7 or earlier, updating to 2.8.8 fixes the issue. The patch properly validates Apple identity tokens against Apple's public signing keys before accepting them.

If you can't update immediately — maybe you're running a compatibility setup or need to test first — disabling the Apple login method is a stopgap. The vulnerability is specifically in the Apple token handler, so Facebook, Google, Amazon, and PayPal logins aren't affected by this particular CVE.

The broader pattern

This is the second major authentication bypass disclosed in a WordPress e-commerce plugin in recent months. The pattern is consistent: a plugin implements a third-party login flow, cuts corners on token verification, and leaves the door wide open for anyone who understands how JWTs work.

The Apple login path is a common weak spot because Apple's Sign In implementation is more complex than the typical OAuth flow. Apple sends identity tokens as JWTs rather than using a simple authorization code exchange, and the token verification requires fetching Apple's public keys and validating the signature chain. It's not hard to implement correctly, but it's easy to implement incorrectly by skipping the signature check and trusting the token payload at face value.

For store owners, the practical takeaway is straightforward: audit every plugin that handles authentication. If a plugin adds a social login method, check whether it's actively maintained and whether the developer has a track record of responding to security disclosures. A plugin that handles login but hasn't been updated in six months is a liability, regardless of how many five-star reviews it has.

If you're running WooCommerce Social Login, check your version now. If you're on 2.8.7 or below, update today. The vulnerability has been public for over a month, which means attackers have had plenty of time to build and share exploits.

Sources: WooCommerce Social Login Plugin Enables Full Site Takeover — Search Engine Journal, Aug 3, 2026 · Wordfence Vulnerability Advisory — CVE-2026-8457