CVE-2026-8457, a 9.8-rated authentication bypass vulnerability disclosed on August 1, 2026, allows unauthenticated attackers to log in as any user—including administrators—on WordPress sites running WooCommerce Social Login plugin versions up to 2.8.7, according to Wordfence research reported by Search Engine Journal. The flaw exploits the plugin's Apple login handler, which fails to validate identity tokens against Apple's public keys, enabling attackers to forge tokens containing any existing user's email address and immediately gain authenticated access.
TL;DR: A critical vulnerability in WooCommerce Social Login plugin lets unauthenticated attackers log in as any user by forging Apple identity tokens; all versions through 2.8.7 are affected, with version 2.8.8 releasing the patch.
Plugin Processes Millions of E-Commerce Logins
WooCommerce Social Login enables one-click authentication for online store customers through Facebook, Google, Amazon, PayPal, and Apple accounts. The plugin reduces checkout friction by eliminating manual account creation, a feature widely deployed across WooCommerce installations managed by agencies handling e-commerce client work. Sites using versions 2.8.7 or earlier are vulnerable to complete administrative takeover through the Apple login flow.
The vulnerability affects the plugin's Apple identity token processing. When a user authenticates via Apple, the service provides an identity token containing user information protected by a digital signature. The plugin should verify this signature against Apple's public keys before granting access. Instead, the plugin accepts unverified tokens, allowing attackers to craft payloads containing any registered user's email address.
No Authentication Required for Exploit
The exploit requires no existing WordPress user role, making it an unauthenticated attack. "This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by supplying a forged id_token whose payload contains the target user's email address," Wordfence stated in its disclosure. The plugin uses the email address from the forged token to resolve a WordPress account and immediately issues an authenticated session, with no role exclusion logic protecting administrator accounts.
Once attackers gain administrator access, they control the entire WordPress installation, including customer data, order information, payment gateway credentials, and site content. The 9.8 CVSS score reflects both the ease of exploitation and the severity of impact.
Patch Available Since Version 2.8.8
The plugin maintainers released version 2.8.8 with a fix for CVE-2026-8457. Wordfence recommends immediate updates for any installation running version 2.8.7 or earlier. Sites that have not updated remain exposed to full administrative compromise through forged Apple login attempts.
This disclosure follows a pattern of authentication bypass vulnerabilities in WordPress plugins throughout 2026. WordPress plugin vulnerabilities reported 250+ weekly disclosures through 2026, with 43% exploitable without authentication. Earlier in August, the Ultimate Member plugin exposed password reset links on 200,000 sites, and in July an authorization bypass in WooCommerce ERP plugin allowed subscriber-level users to corrupt business data.
What This Means for Agency Owners
Agencies managing WooCommerce client sites must audit plugin versions immediately and deploy the 2.8.8 update across all installations using WooCommerce Social Login. The authentication bypass requires no special access, meaning any site running the vulnerable version is at risk of full administrative takeover until patched. Client agreements should specify plugin security monitoring as a deliverable, with documented update protocols that prevent multi-week exposure windows.
This vulnerability highlights the security liability agencies carry when white-labeling e-commerce development. Client sites running outdated plugins expose both the client and the agency to data breach liability, payment card compliance failures, and customer trust damage. Agencies without dedicated WooCommerce developers monitoring security disclosures should establish automated plugin update workflows or partner with security-focused WordPress teams that track CVE disclosures in real time.
Sites running the vulnerable plugin should also conduct post-compromise audits if the plugin remained at version 2.8.7 after August 1, 2026. Check access logs for unexpected Apple login attempts, review administrator account activity for unauthorized sessions, and confirm no backdoor accounts were created during any potential exploitation window.