CVE-2026-8457 is an authentication bypass vulnerability in the WooCommerce - Social Login WordPress plugin (<=2.8.7). The vulnerability exists because the Apple login handler does not verify the JWT signature of the id_token against Apple's public keys, nor does it validate critical JWT claims like issuer, audience, or expiry. Furthermore, the security nonce needed to initiate the login flow is exposed publicly via a localized JavaScript object on the login page. An attacker can exploit this by crafting a forged id_token containing the email address of any existing WordPress user. Since the plugin uses this email to resolve the WordPress account without role restrictions, the attacker can log in as that user immediately, effectively bypassing authentication controls.

Successful exploitation allows unauthenticated attackers to log in as any existing WordPress user, including administrators. This leads to full compromise of the WordPress site with complete confidentiality, integrity, and availability impact. The vulnerability has a CVSS 3.1 base score of 9.8 (critical), reflecting its ease of exploitation and severe consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable the Apple login feature in the WooCommerce - Social Login plugin or avoid using the plugin entirely. Monitor official WPWeb communications for updates and apply any official patches once released.