The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin'…

CVE-2026-8457 affects the WooCommerce Social Login plugin for WordPress in all versions up to and including 2.8.7. The vulnerability allows unauthenticated attackers to bypass authentication by exploiting the Apple login handler, which accepts and decodes Apple id_tokens without verifying JWT signatures against Apple's public keys. Additionally, the plugin fails to validate issuer, audience, or expiry claims. The security nonce required to invoke the login flow is publicly exposed to unauthenticated users via a localized JavaScript object on the login page. By supplying a forged id_token containing a target user's email address, an attacker can log in as any existing WordPress user, including administrators. The plugin resolves WordPress accounts solely based on email address with no role exclusion, immediately issuing an authenticated session. This represents a critical authentication bypass with full account takeover potential.