CVE-2026-77001 Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass
Unauthenticated attackers can bypass authentication to gain administrator access via a vulnerable login handler in the SoClever WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77001?
CVE-2026-77001 is a critical authentication bypass vulnerability in Unknown Social Login & Sharing buttons with Analytics By SoClever, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.
Weakness: CWE-287
Which versions are affected by CVE-2026-77001?
How do I fix CVE-2026-77001?
No fix has been published for CVE-2026-77001 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-77001 being exploited?
There is no known exploitation of CVE-2026-77001 in the wild and no public exploit code.
Sources
Also known as GHSA-rpcc-rx9m-g3cx.