An authentication bypass vulnerability in the WooCommerce - Social Login plugin allows unauthenticated attackers to hijack any user account, including administrative accounts.

The plugin fails to verify JWT signatures against Apple's public keys and does not validate essential claims like issuer or audience. Combined with publicly exposed security nonces on the login page, an unauthenticated attacker can forge an identity token to masquerade as any existing user.

This vulnerability is critical, carrying a CVSS score of 9.8. Because an attacker can impersonate administrators, the impact includes total site compromise, data theft, and unauthorized modification of store configurations. The ease of exploitation via simple token forgery makes this an attractive target for automated attacks against vulnerable WordPress installations.

Immediate Action: Update the WooCommerce - Social Login plugin to the latest available version beyond 2.8.7 immediately.

Proactive Monitoring: Review WordPress user logs for suspicious login activity, specifically looking for unexpected logins from administrative accounts or social login identifiers that do not align with known user behavior.

Compensating Controls: If an immediate update is not possible, deactivate the Social Login feature entirely to remove the vulnerable code path from the public-facing login flow.

Public Exploit Available: No (exploit_available: false)

Immediate remediation is required for all sites utilizing this plugin. Administrators should verify the plugin version and apply updates to prevent potential full-site takeover by unauthenticated remote attackers.