CVE-2026-77001: CWE-287 Improper Authentication in Social Login & Sharing buttons with Analytics By SoClever

The vulnerability in the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin (up to version 1.2.0) arises from a lack of authentication, authorization, and nonce verification in a publicly accessible login handler. This security oversight enables unauthenticated attackers to impersonate any user by obtaining a valid session token. In the default configuration, this results in an attacker gaining administrative access without any credentials, effectively compromising the site’s security.

An attacker can gain unauthorized administrative access to a WordPress site using the affected plugin without any authentication or knowledge of user credentials. This can lead to full site compromise, including data theft, site defacement, or further malicious activity under the guise of a legitimate administrator session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable or remove the vulnerable plugin to prevent exploitation. Monitor official vendor channels for updates and apply any released patches promptly.