A critical authentication bypass vulnerability in the WP Social Media Login plugin allows unauthenticated attackers to assume control of any user account, including administrative accounts.

The plugin suffers from improper authentication (CWE-287) where it fails to verify the integrity of the social identity provider callback. An unauthenticated attacker can supply a target user email address to the authentication endpoint to bypass security controls and gain unauthorized access.

This vulnerability poses a severe risk to organizational security, as it grants attackers full administrative access to the affected WordPress site. Given the CVSS score of 9.8, the potential for total system compromise, data exfiltration, and unauthorized administrative actions is extremely high, necessitating immediate intervention to prevent complete service takeover.

Immediate Action: If a patched version is not yet available from the vendor, immediately deactivate and remove the WP Social Media Login plugin until a secure update is released and verified.

Proactive Monitoring: Review web server and WordPress authentication logs for suspicious login patterns or unexpected administrative account access originating from unknown or unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious traffic patterns directed at social login endpoints, though this should be considered a temporary measure pending full removal of the vulnerable code.

Public Exploit Available: No

This vulnerability represents a critical security failure that could lead to a total compromise of the WordPress environment. Administrators should treat this as a high-priority incident and remove the affected plugin immediately if an official patch is not available, as the risk of account takeover is significant and trivial to execute.