CVE-2026-8457 WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
Unauthenticated attackers can log in as any user, including administrators, by forging Apple JWT tokens due to missing signature validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8457?
CVE-2026-8457 is a critical authentication bypass vulnerability in WPWeb WooCommerce - Social Login, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined with the security nonce required to invoke the login flow being publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying a forged id_token whose payload contains the target user's email address, as that email is used without any role exclusion to resolve a WordPress account and immediately issue an authenticated session for it.
Weakness: CWE-289
Which versions are affected by CVE-2026-8457?
How do I fix CVE-2026-8457?
No fix has been published for CVE-2026-8457 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-8457 being exploited?
There is no known exploitation of CVE-2026-8457 in the wild and no public exploit code.
Sources
Also known as GHSA-qwc9-q2f8-q72q.