CVE-2023-2982: WordPress Social Login plugin authentication bypass via weak encryption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction required, and full takeover of any account including administrator, combined with a high EPSS score.

What it is

The WordPress Social Login and Register plugin (Discord, Google, Twitter, LinkedIn) up to version 7.6.4 fails to properly encrypt the user identity supplied during a plugin-validated login. This lets an unauthenticated attacker log in as any existing user, including an administrator, if they know that user's email address. It was partially patched in 7.6.4 and fully patched in 7.6.5.

Impact

An attacker gains full account takeover of any user whose email address they know, including administrator accounts, leading to complete site compromise.

Attack surface

Reachable over the network through the plugin's social login flow with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The attacker only needs a valid email address of a target account.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is high at roughly 0.46 (98.8th percentile), indicating elevated likelihood of exploitation. References are product and third-party advisory links only, with no public exploit tag.

What to do

• Update the plugin to version 7.6.5 or later, which contains the full fix.
• If immediate patching is not possible, disable the plugin until it can be updated.
• Enforce strong unique passwords and multi-factor authentication on all WordPress accounts, especially administrators.
• Audit administrator and privileged accounts for unexpected logins or changes made during the exposure window.
• Restrict or monitor access to the plugin's social login endpoints at the web server or WAF layer.

Detection

• Review WordPress authentication logs for successful logins to existing accounts that did not go through the normal password or expected social provider flow.
• Alert on logins to administrator or other privileged accounts from new IP addresses or user agents.
• Monitor for plugin-related requests to the social login callback or validation endpoints, especially with unusual or tampered parameters.
• Check for new administrator users, changed credentials, or unexpected plugin/theme modifications following suspicious logins.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.