CVE-2026-8457 is an authentication bypass vulnerability in the WooCommerce - Social Login WordPress plugin (up to and including version 2.8.7). The flaw is due to improper validation of Apple's id_token during the login process: the plugin decodes the token's base64 payload but does not verify the JWT signature against Apple's public keys nor validate critical claims such as issuer, audience, or expiry. Furthermore, the security nonce required to initiate the login is exposed publicly in a localized JavaScript object on the login page, enabling unauthenticated attackers to craft forged id_tokens containing the email address of any existing WordPress user. Because the plugin uses the email from the token payload without role restrictions, attackers can impersonate any user, including administrators, thereby gaining full authenticated access.

Successful exploitation allows unauthenticated attackers to bypass authentication and log in as any existing WordPress user, including administrators. This results in complete compromise of the affected WordPress site, with full control over user accounts and potentially the entire site content and configuration. The vulnerability has a CVSS score of 9.8, indicating critical severity with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the Apple login feature in the WooCommerce - Social Login plugin or avoid using the plugin entirely. Monitor vendor channels for updates and apply any official patches promptly once released.