CVE-2026-77001

CVE-2026-77001 is a critical authentication bypass in a WordPress social login plugin (SoClever). The vulnerability lives in the OAuth callback handler, which fails to validate state/nonce tokens — meaning an attacker can craft a malicious callback that the application trusts without verification. The result: complete account takeover of the site's original administrator, obtained without any credential knowledge or user enumeration. The attack surface here is unusually large. Because the exploit requires zero enumeration — it grabs the first administrator account by WordPress's deterministic user ordering — this is trivially automatable. A single scanner script could compromise every vulnerable installation without knowing anything about any target site. The original administrator in WordPress isn't just 'an admin' — they hold implicit trust that other accounts don't, with the ability to install plugins, modify themes, and access database credentials through wp-config. In multisite deployments, that privilege extends network-wide. Worse, this plugin appears moribund or abandoned. If no maintainer exists to issue a patch, the CVE confirms exposure rather than triggering remediation. WordPress has no standard mechanism to retire abandoned plugins — vulnerable code persists indefinitely in the install base. The exposure window for this class of vulnerability isn't a gap that closes; for abandoned plugins, it's a permanent state. What to do: Audit your WordPress deployment for any unused or unmaintained social login plugins and remove them. If you must use social login, verify the plugin maintains active development and has recent security review. Check that your OAuth callback handlers validate state parameters — this is non-negotiable. The pattern here (missing nonce checks in OAuth callbacks) has appeared across multiple WordPress plugins over the years; treat any social login implementation as auth-critical code requiring explicit security documentation of every session-establishment assumption.

Reviewed through automated stages and approved by a human before publication.