CVE-2026-8457: WooCommerce Social Login Let Anyone Log In as Admin

A vulnerability disclosed on August 1, 2026 in the WooCommerce Social Login plugin let an attacker log in as any user on your store, including a full administrator, without ever needing a password. It carries a CVSS score of 9.8, close to the maximum possible. If you run WooCommerce sites for clients and any of them offer "Login with Apple," I would check this today.

What actually happened

WooCommerce Social Login lets customers sign in through Facebook, Google, Amazon, PayPal, or Apple instead of creating a separate store account. The flaw, tracked as CVE-2026-8457, sits specifically in the Apple login handler. Research from Wordfence found that the plugin's Apple login code trusted the identity token's claimed email address without actually checking that Apple had signed the token in the first place.

In plain terms, when someone logs in with Apple, the plugin receives a signed token asserting who that person is. Verifying that signature against Apple's public keys is the entire point of the exercise, since anyone can write a token claiming to be anyone. This plugin skipped that verification step. An attacker could construct their own token, put an existing admin's email address inside it, and the plugin would accept it and log them in as that admin. No password, no code, no prior access required.

Who is actually affected

Every version of WooCommerce Social Login up to 2.8.7 contains the vulnerable code. In practice, the real exposure sits with stores that actually have the Apple login option turned on for customers, since that is the specific code path involved. If Apple login has never been enabled on a site, this particular flaw has less of a path in, though I would still update regardless, since a disabled feature today can get switched on later without anyone remembering to double check it.

The fix

Update to WooCommerce Social Login version 2.8.8 or later. This patched version actually verifies the token signature against Apple's public keys before trusting anything inside it.

What to check if you manage client sites

Beyond just updating the plugin, I would look at your WordPress user list for any administrator account you do not recognize, especially ones created recently with an email address that does not match a real customer or team member. If you run a security plugin that logs login activity, check for Apple login events around the timeframe before this was patched. Any successful login as an existing admin account that the real admin does not remember making is worth treating seriously, not dismissing.

The catch: this is not really about one plugin

I want to widen the lens a bit here, since I think the bigger lesson matters more than this one CVE. WordPress plugin vulnerabilities have been disclosed at a pace of over 250 per week through 2026, and roughly 43 percent of them need no authentication at all to exploit. This is not the only serious authentication flaw this year. A separate issue in the Ultimate Member plugin exposed password reset links on around 200,000 sites earlier in August, and an authorization bypass in WooCommerce ERP let low-privilege subscriber accounts corrupt business data back in July.

Reacting to each CVE one at a time as it appears is necessary, but it is not a strategy on its own. The more durable habit is reducing what is actually turned on across your client sites in the first place. If a store has three social login providers enabled but customers only ever use one, the other two are pure exposed surface area with no upside. I would go through your client sites and disable any login provider, plugin feature, or integration that nobody is actually using, since a feature that is off cannot be the entry point for a vulnerability nobody has found yet.

FAQ

Does this affect Facebook, Google, Amazon, or PayPal login too?
The disclosed vulnerability is specific to the Apple login handler's token verification. I would still update to the current version regardless, since a single plugin update covers the fix for all providers it ships.

How would I know if an attacker already used this against my site?
Check your list of administrator and other privileged user accounts for anything unfamiliar, particularly ones tied to an email address you do not recognize as a real customer or staff member. Compare account creation dates against when this vulnerability was public.

Is disabling unused login providers actually going to stop future vulnerabilities?
It will not stop a vulnerability from existing in plugin code, but it does mean a flaw in a feature you never use cannot be used against your site, since the vulnerable code path is simply never reached in normal operation.

Should I remove WooCommerce Social Login entirely instead of just updating it?
If customers genuinely use social login on a store, I would keep it and just stay current on updates. If it was enabled once and nobody actually uses it, removing it entirely is a cleaner outcome than leaving an unused feature installed and exposed.

Is a CVSS score of 9.8 unusually high?
Yes, that score reflects a vulnerability that is both easy to exploit and severe in impact, in this case full unauthenticated account takeover. It sits near the top of the scale, and I would treat any plugin vulnerability scored this high as an immediate priority, not something to batch into a routine update cycle.

Bottom line

Update WooCommerce Social Login to 2.8.8 today if you have not already, and actually check your admin user list for anything unfamiliar rather than assuming an update alone closes the door on whatever already happened. Then take the wider lesson seriously. Every login provider, plugin feature, or integration sitting enabled but unused on a client site is exposure you are carrying for free, with nothing to show for it.

Sources: Webmastered, WooCommerce Social Login Plugin Enables Site Takeover via CVE-2026-8457, citing Wordfence research. Verified against reported disclosure details on August 30, 2026.