If your WooCommerce store uses the WooCommerce Social Login plugin, stop and update it now. A critical flaw lets attackers log in as any user on your site, including administrators, without a password.
What happened
WooCommerce Social Login lets customers sign in with accounts from Facebook, Google, Amazon, PayPal, or Apple instead of creating a new password. The flaw sits in how the plugin handles Apple sign-in.
When someone signs in with Apple, Apple sends an identity token, a signed piece of data confirming who the person is. The plugin is supposed to check that signature against Apple’s public keys before trusting the token. It doesn’t. That means anyone can forge a token containing an existing user’s email address, hand it to the plugin, and get logged in as that person instantly.
Because the plugin never excludes administrator accounts from this process, an attacker who knows (or guesses) an admin’s email can walk straight into the WordPress dashboard with full control of the site.
Wordfence, which discovered and disclosed the issue, rated it 9.8 out of 10, about as severe as vulnerabilities get. The flaw is tracked as CVE-2026-8457 and was publicly disclosed on August 1, 2026.
Who is affected
Every site running WooCommerce Social Login version 2.8.7 or earlier is vulnerable. No customer interaction is needed, and the attacker doesn’t need an account on your site to start.
What to do
Update WooCommerce Social Login to version 2.8.8 or later immediately. If your store handles customer orders, payment details, or any sensitive data, treat this as a same-day fix, not something to schedule for later.
If you’re not actively using the Apple login option, consider disabling it in the plugin settings until you’ve confirmed the update is installed.
End of article