CVE-2026-8457: Auth Bypass in WooCommerce Social Login via Forged Apple JWT

Published on 2 August 2026

An attacker needs no password, no stolen credentials and no insider – a single, self-crafted data record is enough to log in as the administrator of your online shop. That's exactly what a critical security vulnerability in the widely used WordPress plugin WooCommerce – Social Login makes possible. Since 1 August 2026, the flaw has been publicly known under the identifier CVE-2026-8457, it carries the maximum possible severity rating (CVSS score 9.8 out of 10) – and it is already being actively exploited. Anyone using this plugin must act now.

What happened?

On 1 August 2026, the security firm Wordfence disclosed a critical vulnerability in the "WooCommerce – Social Login" plugin from the vendor WPWeb. All versions up to and including 2.8.7 are affected.

The plugin allows customers of a WooCommerce shop to conveniently log in via external services such as Apple, instead of entering a username and password every time. It is precisely in this Apple login function that the fatal flaw lies: an unauthenticated attacker – that is, someone who is not logged in and possesses no credentials whatsoever – can log in as any WordPress user, including administrators.

Wordfence describes the problem in no uncertain terms:

„This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying a forged id_token whose payload contains the target user's email address…“ (Source: Wordfence Threat Intelligence)

In plain terms: attackers can log in as any existing user by submitting a forged token containing the target user's email address. The attack can be carried out over the internet, requires no prior knowledge about the target other than the administrator's (often publicly visible) email address, and grants full control immediately.

The technical background – explained clearly

To understand why this flaw is so dangerous, it helps to look at how the Apple login is actually supposed to work.

When a user logs in via Apple, Apple returns a so-called id_token – a JWT (JSON Web Token, a digitally signed credential in text form). Among other things, this token contains the user's email address. The crucial point: Apple signs this token cryptographically with a secret key. Every website that accepts the login must verify the token's signature against Apple's public keys. This is the only way to ensure that the token really originates from Apple and has not been forged.

It is precisely this verification that does not take place in the WooCommerce Social Login plugin. The responsible part of the code merely decodes the token (base64 decoding – a simple text conversion, not a security check) and reads out the email address it contains. What does not happen:

• the cryptographic signature is not verified (does the token really come from Apple?),
• the issuer is not validated,
• the audience is not checked,
• and the expiry date is ignored.

In technical terms, this class of flaw is classified as CWE-289 (Authentication Bypass by Alternate Name) – that is, circumventing authentication via an alternative route.

To make matters worse: the login process usually requires a nonce – a one-time security token intended to secure requests. But this nonce is publicly retrievable by anyone on the login page via a JavaScript object, including for visitors who are not logged in. This means even this last small hurdle falls away.

So an attacker only has to craft a token containing the administrator's email address, send along the publicly visible nonce – and the plugin immediately establishes an authenticated session as that administrator. The VulDB Data Team sums up the significance as follows:

„The vulnerability in the WooCommerce - Social Login plugin represents a critical authentication bypass flaw that undermines the security of WordPress installations… The operational impact of this vulnerability extends beyond simple unauthorized access to encompass potential full system compromise.“ (Source: VulDB)

Who is affected?

All websites using the "WooCommerce – Social Login" plugin from the vendor WPWeb in a version up to and including 2.8.7 are affected. The plugin is sold through the CodeCanyon marketplace and records 3,564 sales there.

This is particularly relevant for the German-speaking region: WooCommerce holds a market share of over 14% in the DACH region, making it one of the most widely used shop solutions. Anyone running a WooCommerce shop and offering the convenience of Social Login should definitely go through the following checks.

How to check whether you are affected

1. Plugin check: Log in to the WordPress backend and open the Plugins menu item. Check whether "WooCommerce – Social Login" (from the provider wpweb) is installed.
2. Check the version number: Verify the version number shown. If it is 2.8.7 or lower, your site is vulnerable.
3. Review the logs: Go through your server and WordPress logs for unusual logins – in particular, successful logins to administrator accounts without any prior failed login attempts. This is a typical sign of a successful auth bypass.

What you need to do now

Because the flaw is already being actively exploited, the rule is: act immediately. The vendor WPWeb has fixed the flaw.

1. Update immediately: Bring the "WooCommerce – Social Login" plugin up to the patched version 2.8.8 or higher. This version was released on 27 July 2026.
2. Emergency deactivation: If you cannot apply the update immediately, temporarily deactivate the plugin. A deactivated plugin cannot be exploited.
3. Check the user list: Under Users in the WordPress backend, check whether any unknown or newly created administrator accounts exist. Delete any suspicious accounts immediately.
4. Reset passwords and terminate sessions: Force a password reset for all administrators and terminate all active sessions. This kicks any attackers who may already be logged in out of the system.

If you find signs of a successful compromise, you should additionally check your files for injected malware – more on that shortly.

Timeline – why urgency is warranted

• 13 May 2026: Wordfence reserves the CVE ID.
• 27 July 2026: WPWeb releases the patch (version 2.8.8).
• 1 August 2026: Wordfence and the NVD publish the vulnerability CVE-2026-8457.
• 2 August 2026: First reports of active exploitation ("exploits in the wild").

Experience shows: once technical details are public, things move fast. According to current statistics, the average time from the disclosure of a vulnerability to mass exploitation is just five hours. Every day without an update is a risk.

Why this can threaten your shop's very existence

This vulnerability is so explosive because it hands an attacker full administrator rights directly – without any hurdle. Whoever controls the WordPress administrator can do practically anything:

• Steal customer data: harvest names, addresses, order histories and other personal data of your customers.
• Inject credit card skimmers: inject malicious code that secretly reads payment data entered at checkout.
• Install malware or ransomware: encrypt the site or abuse it as a distribution point for further attacks.
• Take over the entire shop and lock you out of your own website.

For context: around 13,000 WordPress websites are hacked every day, and in 2025 alone 11,334 new WordPress vulnerabilities were registered – an increase of 42% over the previous year. WordPress security has long since ceased to be a niche topic and has become a permanent operational risk that every shop operator must confront.

GDPR: these obligations await you

An auth bypass that enables unauthorised access to customer data in your WooCommerce shop is, legally speaking, a breach of the protection of personal data within the meaning of Art. 4 No. 12 GDPR – colloquially, a data breach.

If you have indications that the flaw was exploited on your site, clear deadlines and obligations apply:

• Notification of the supervisory authority (Art. 33 GDPR): The data breach must be reported to the competent data protection supervisory authority within 72 hours, since there is a risk to the rights and freedoms of the affected customers – for example through identity theft.
• Notification of the affected individuals (Art. 34 GDPR): If the risk to customers is high, you must additionally inform the affected individuals directly.

Failure to meet these obligations can result in fines of up to 10 million euros or 2% of global annual turnover. Therefore, carefully document every step of your response – this too is part of the accountability requirement.

Conclusion

CVE-2026-8457 is a textbook example of a vulnerability that must not be put on the back burner: maximum severity (CVSS 9.8), remotely exploitable without credentials, direct administrator access – and already being actively exploited. The good news: with version 2.8.8, the vendor has already provided a patch that fixes the missing signature verification of the Apple token.

If you use the "WooCommerce – Social Login" plugin, there is only one correct response: update to version 2.8.8 immediately – or deactivate the plugin until the update. Then check your user list for unfamiliar administrators, reset all admin passwords and take a look at your logs. A few minutes of effort protects you from a potential total outage of your shop, the theft of sensitive customer data and hefty GDPR fines.

Not sure whether your website is affected or has already been compromised? As a consultancy for website security and GDPR, shieldgaps.com supports you with checking, cleaning up and legally sound documentation.