WordPress plugin
WooCommerce - Social Login security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 10 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical5
- High3
- Medium2
- Low0
All WooCommerce - Social Login vulnerabilities
- Critical9.8Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
≤2.8.7Update to 2.8.8
- Medium4.3Cross-Site Request Forgery
≤2.8.2Update to 2.8.3
- High8.1WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider
≤2.7.7Update to 2.7.8
- Critical9.8Social Login <= 2.7.5 - Authentication Bypass to Account Takeover
≤2.7.5Update to 2.7.6
- Critical9.8Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation
≤2.7.3Update to 2.7.4
- High7.3Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password
≤2.7.3Update to 2.7.4
- High7.3Social Login <= 2.7.3 - Unauthenticated Authentication Bypass
≤2.7.3Update to 2.7.4
- Critical9.8Unauthenticated PHP Object Injection
≤2.6.3Update to 2.7.0
- Critical9.8Social Login <= 2.6.2 - Unauthenticated PHP Object Injection
≤2.6.2Update to 2.6.3
- Medium6.5Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness
≤2.6.2Update to 2.6.3
WooCommerce - Social Login: common questions
Does WooCommerce - Social Login have known vulnerabilities?
Yes. VulnCrest Radar lists 10 known vulnerabilities in WooCommerce - Social Login: 5 critical, 3 high, 2 medium. None are known to affect version null.
How do I check which version of WooCommerce - Social Login I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WooCommerce - Social Login vulnerability?
CVE-2026-8457, published Aug 1, 2026: WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT. Severity: Critical (CVSS 9.8).
Is any WooCommerce - Social Login vulnerability listed in CISA KEV?
No. None of the known WooCommerce - Social Login vulnerabilities is currently listed in the CISA KEV catalog.