WPCOM Member plugin: Authentication bypass via social-login callback
Summary
The WPCOM Member plugin for WordPress up to and including version 1.7.27 contains an unauthenticated authentication bypass in its social-login callback handler. An attacker can forge session data with crafted GET requests and log in as any WordPress user, including administrators, if the victim's social provider identifier (openid or unionid) is known or can be discovered. Exploitation requires that at least one social provider is configured on the site.
Affected
- WPCOM Member plugin for WordPress, all versions up to and including 1.7.27
- Exploitation requires at least one social login provider to be configured
Fixed in
- Sources conflict: VulDB and OpenCVE state version 1.7.28 or later; Patchstack and WPScan state version 1.8.0
- Confirm the fixed version on WordPress.org before rollout; 1.8.0 or later is the safe target
Workaround
- No vendor-documented workaround.
- Disable social login providers until the plugin is updated.
- Patchstack customers may receive a virtual patch.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- Patchstack expects exploitation to follow; this is a forecast.
- No public proof-of-concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- EPSS 0.00449 (date unknown).
Our recommendation
- Inventory WordPress sites for the wpcom-member plugin and check the installed version.
- Update to version 1.8.0 or later, confirmed on WordPress.org.
- Disable social login providers until the update is applied, if feasible.
- After updating, review administrator accounts for unexpected users or recent logins, reset administrator passwords and invalidate active sessions.
- Check whether a virtual-patching service or WAF is in place as an interim measure.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- Patchstack vulnerability record patchstack.com
- WPScan plugin page wpscan.com
- VulDB CVE entry vuldb.com
- WordPress.org plugin page wordpress.org
- Trac source: social-login.php (1.7.27) plugins.trac.wordpress.org
- Trac source: class-sesstion.php (1.7.27) plugins.trac.wordpress.org
- OpenCVE entry app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:58.
Original description (NVD)
The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation in the session store, allowing an unauthenticated attacker to issue a crafted GET request that writes an attacker-named, attacker-valued entry into the global session namespace (bypassing the per-visitor prefix by prepending an underscore), then issue a second GET request triggering `weapp_new_user()` to read that forged entry and resolve the attacker-supplied `openid` value to a bound WordPress account before `wp_set_auth_cookie()` establishes a fully authenticated session. This makes it possible for unauthenticated attackers to log in as any WordPress user — including administrators — whose bound social provider identifier (openid/unionid) is known or discoverable. Successful exploitation requires that the target site has at least one social provider configured (which activates the vulnerable handler) and that the attacker knows or can enumerate the victim account's bound openid or unionid.
NVD references (6)
- https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.27/includes/class-sesstion.php#L13
- https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.27/includes/social-login.php#L1235
- https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.27/includes/social-login.php#L674
- https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.27/includes/social-login.php#L91
- https://plugins.trac.wordpress.org/browser/wpcom-member/trunk/includes/social-login.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3dee7f76-bd66-4e54-8ef6-bbf581ebcc11?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.