A critical authentication vulnerability in the SoClever Social Login & Sharing buttons plugin allows unauthenticated attackers to gain full administrative access to affected WordPress sites.

The plugin fails to perform necessary authentication, authorization, or nonce validation within a public login handler, permitting unauthenticated attackers to forge sessions for any existing user.

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of total system compromise. By gaining administrative access without credentials, attackers can execute arbitrary code, modify site content, exfiltrate sensitive data, or redirect users to malicious domains, leading to severe reputational damage and potential regulatory non-compliance.

Immediate Action: If a patched version is not yet available, immediately deactivate and remove the plugin from all WordPress installations until a vendor-supplied security update is confirmed.

Proactive Monitoring: Review access logs for suspicious administrative logins, particularly those originating from unrecognized IP addresses or occurring outside of normal business hours.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the plugin's specific login handler endpoints.

Public Exploit Available: No

Given the critical nature of this flaw and the lack of a verified patch, administrators must prioritize the removal of the vulnerable plugin immediately. The ability for an unauthenticated attacker to assume an administrator session presents an unacceptable risk to the integrity and availability of the affected WordPress environment.