CVE-2026-77001
published 2026-08-22CVE-2026-77001: The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.63%
47.9th percentile
The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
SoClever Social Login & Sharing buttons with Analytics Plugin improper authentication (EUVD-2026-64226)
vuldb·2026-08-24·CVSS 9.8
CVE-2026-77001 [CRITICAL] SoClever Social Login & Sharing buttons with Analytics Plugin improper authentication (EUVD-2026-64226)
A vulnerability was found in SoClever Social Login & Sharing buttons with Analytics Plugin up to 1.2.0 on WordPress. It has been classified as critical. This vulnerability affects unknown code of the component Login Handler. Performing a manipulation results in improper authentication.
This vulnerability is reported as CVE-2026-77001. The attack is possible to be carried out remotely. No exploit exists.
GHSA
The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login
ghsa_unreviewed·2026-08-22
CVE-2026-77001 The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login
The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-22
Published