CVE-2026-103898

{
  "etk_id": "ETK-2026-3158",
  "cve_id": "CVE-2026-103898",
  "display_id": "CVE-2026-103898",
  "ghsa_id": "GHSA-g8pp-vmv3-x6hw",
  "euvd_id": "EUVD-2026-114656",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authentication bypass in Wp Social Login and Register Social Counter",
  "summary": "Wp Social Login and Register Social Counter through version 3.2.2 can accept a social-login identity without reliably validating ownership of the matching email address. An unauthenticated attacker could sign in as an existing WordPress user, including an administrator, if Facebook or Twitter login is configured and the provider returns that user's email.",
  "mitigation": "Disable the plugin or its Facebook and Twitter social-login features until a corrected release is available. Review active WordPress sessions and privileged accounts for unexpected access.",
  "vendor": "roxnor",
  "product": "Wp Social Login and Register Social Counter",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.2.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Wp Social Login and Register Social Counter",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.008561833333333333,
  "t0_at": "2026-10-31T07:46:52.815000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-31T07:59:52.738979+00:00",
      "days": 0.009026897905092592,
      "is_lower_bound": false,
      "measured_at": "2026-10-31T07:46:52.815000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-31T07:46:52.815000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-31T07:46:52.815000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103898"
    }
  }
}