On 1 August a vulnerability in the WooCommerce Social Login plugin was disclosed as CVE-2026-8457, rated 9.8 out of 10. It affects every version up to and including 2.8.7. The fix is 2.8.8. If you run that plugin, go and update it before you finish this paragraph.

What the flaw actually does

The plugin accepts an Apple sign-in token and decodes its payload without verifying the signature or checking the standard claims. Separately, the nonce needed to start the login flow is exposed to visitors who are not logged in. Put those two together and an attacker who supplies a forged token containing an administrator’s email address receives a valid session as that administrator.

No password. No brute force attempt. No string of failed logins in your logs to notice.

For a marketing site, an administrator session is not an abstract risk. It is the ability to inject spam links into every published post, redirect your traffic to another domain, add a card skimmer to checkout, or quietly create a second admin account and wait a few months.

The check, which takes about twenty minutes

1. Open Plugins in WordPress admin and search for “Social Login”. It may be listed as Social Login for WordPress and WooCommerce.
2. If the version is 2.8.7 or lower, update now. If a developer or agency manages your updates, message them today rather than adding it to the next sprint.
3. Open Users, sort by registration date, and look for administrator accounts you do not recognise, particularly recent ones.
4. Check for role changes. A subscriber quietly promoted to administrator is the usual signature.
5. If you do not use social login at all, deactivate and delete the plugin rather than leaving it installed but inactive.

The two things people get wrong

“We do not use social login” is not the same as “we are not affected”. Plenty of WooCommerce sites installed this plugin during a redesign two years ago, tested it, decided against it, and left it sitting there. The plugin does not need customers actively using it for its endpoints to exist on your server.

The second error is assuming a security plugin has it covered. Firewall rules for a newly disclosed vulnerability arrive after disclosure, and free tiers usually receive them later than paid ones. A patched plugin beats a rule that might block the request.

If you find something

Do not simply delete an unfamiliar administrator account and move on. Change every administrator password, force a logout of all sessions, rotate any API keys stored in the site, and look at scheduled tasks and theme files for anything added recently. If the site takes payments, this stops being a DIY cleanup and becomes a conversation with your payment provider.

How far you take this depends on what the site holds. A brochure site with a contact form and a store processing card details are different problems, and treating them the same wastes either your money or your evening.

The habit worth building

Small teams tend to count plugins as features. A better habit is to count them as suppliers. Every plugin is a company or an individual you have handed administrator-level trust, usually without ever checking whether they still maintain the code. Plenty of plugins on a site that has been running five years are no longer maintained by their authors, and nobody notices until a disclosure like this one lands.

The practical version of that idea is not a policy document nobody reads. It is a fifteen minute pass through your plugin list once a quarter, deleting anything whose purpose you cannot explain out loud. Full details of the affected versions are in this write-up of the WooCommerce Social Login vulnerability. Do the check today. This one does not need a maintenance window.

The post A WooCommerce Login Plugin Handed Out Admin Access. Check Yours Today. appeared first on Mark8ng.com.