CVE-2026-77001: CWE-287 Improper Authentication in Social Login & Sharing buttons with Analytics By SoClever

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin versions up to 1.2.0 contain an improper authentication vulnerability (CWE-287). One of its publicly accessible login handlers does not enforce authentication, authorization, or nonce validation, enabling unauthenticated attackers to impersonate any user, including administrators, by obtaining a valid session. This vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker can gain unauthorized access to any user account on the affected WordPress site, including the original administrator account, without needing any credentials. This compromises the confidentiality, integrity, and availability of the site, allowing full control over site administration and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable plugin's login handlers or disable the plugin to prevent exploitation.