WooCommerce - Social Login

WooCommerce - Social Login has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 10 are fixed as of September 2026. Their average CVSS score is 8.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 5 critical and 3 high. 2024 was the busiest year with 8 disclosures.

The most common weakness is Authentication Bypass Using An Alternate Path Or Channel, behind 2 of the records (20%). Other recurring categories include Deserialization Of Untrusted Data, Authentication Bypass By Alternate Name.

Every one of the 10 issues recorded for WooCommerce - Social Login has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, most of them (3) reported by Vu Nguyen (maxntv).

Strategic Overview

Avg CVSSHigh

8.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WooCommerce - Social Login vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-8457

WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT

Read the full analysis

Vulnerability Records

10 records


2026-08-01 11:09	WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT WooCommerce - Social Login <= 2.8.7	`CVE-2026-8457`	9.8 Critical	Rafie Muhammad	Yes
2025-04-16 00:00	WooCommerce Social Login <= 2.8.2 - Cross-Site Request Forgery WooCommerce - Social Login <= 2.8.2	`CVE-2025-39472`	4.3 Medium	Ananda Dhakal	Yes
2024-11-04 00:00	Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider WooCommerce - Social Login <= 2.7.7	`CVE-2024-10114`	8.1 High	wesley (wcraft)	Yes
2024-08-09 13:23	WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover WooCommerce - Social Login <= 2.7.5	`CVE-2024-7503`	9.8 Critical	Truoc Phan	Yes
2024-07-19 00:00	WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password WooCommerce - Social Login <= 2.7.3	`CVE-2024-6637`	7.3 High	Vu Nguyen (maxntv)	Yes
2024-07-19 00:00	WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass WooCommerce - Social Login <= 2.7.3	`CVE-2024-6635`	7.3 High	Vu Nguyen (maxntv)	Yes
2024-07-19 00:00	WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation WooCommerce - Social Login <= 2.7.3	`CVE-2024-6636`	9.8 Critical	Vu Nguyen (maxntv)	Yes
2024-07-05 00:00	WooCommerce Social Login <= 2.6.3 - Unauthenticated PHP Object Injection WooCommerce - Social Login <= 2.6.3	`CVE-2024-37502`	9.8 Critical	Ananda Dhakal	Yes
2024-06-14 00:00	WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness WooCommerce - Social Login <= 2.6.2	`CVE-2024-5868`	6.5 Medium	István Márton	Yes
2024-06-14 00:00	WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection WooCommerce - Social Login <= 2.6.2	`CVE-2024-5871`	9.8 Critical	István Márton	Yes

Showing 1–10 of 10 reports