On August 1, 2026, Wordfence disclosed a critical authentication bypass in the WooCommerce – Social Login plugin (WPWeb Elite), tracked as CVE-2026-8457 (CVSS 9.8).
The short version: the plugin's Apple login handler accepts an id_token, decodes its base64 payload — and never verifies the JWT signature, issuer, audience, or expiry. Combined with a login nonce that's publicly exposed via wp_localize_script, an unauthenticated attacker can log in as any existing WordPress user, including administrators, by forging a token whose payload contains the target's email.
No password. No 2FA. No user interaction. Just an email address.
The technical breakdown
The vulnerable flow, in pseudocode terms:
