WooCommerce Social Login: Apple Sign-In Bug

If your WooCommerce store uses the "Social Login for WooCommerce" plugin (the CodeCanyon add-on) with "Sign in with Apple" turned on, attackers can log into any customer or admin account without a password, right now, until you update or disable it. This is a critical, actively disclosed flaw tracked as CVE-2026-8457.

This post is for WooCommerce store owners, developers, and agencies running this specific plugin. You'll get a plain-English breakdown of what went wrong, whether your store is exposed, and the exact steps to lock things down today.

What plugin are we talking about?

The vulnerable plugin is "WooCommerce - Social Login", a premium (paid) plugin sold on CodeCanyon (item #8495883). It's a third-party add-on that lets your customers log in or register using Google, Facebook, or Apple instead of creating a password.

It's easy to confuse with "WooCommerce" itself, the core plugin that runs your store. This bug is not in WooCommerce core. It's in this separate social-login add-on. If you don't have this specific plugin installed, this CVE doesn't apply to you.

What actually went wrong

According to the official record on the National Vulnerability Database (NVD), the bug lives in how the plugin handles "Sign in with Apple."

Here's the plain-English version:

When a customer signs in with Apple, Apple hands your site a signed digital note called a JWT (JSON Web Token), specifically an "id_token." That note contains the customer's identity, like their email address, and it's cryptographically signed by Apple so your site can verify it's genuine and untampered.

A correct implementation checks that signature against Apple's public keys, and double-checks the token's issuer, audience, and expiry date, before trusting anything inside it. This plugin skipped all of that. It only decoded the base64 text of the token (basically unwrapping it) and read the email address straight out, with no signature check at all.

That alone would be bad. It gets worse: triggering the Apple login flow normally requires a "security nonce," a one-time code WordPress uses to stop forged requests. But this nonce was exposed publicly, to anyone, logged in or not, through a JavaScript variable sitting right on the login page.

Put the two together and the attack is simple:

1. Visit the store's login page and grab the publicly exposed nonce (no account needed).
2. Build a fake "Apple" token containing the target's email address, for example an admin's publicly known email.
3. Send the forged token and nonce to the plugin's login handler.
4. The plugin matches the email to an existing WordPress account and hands back a fully authenticated session, no password, no real Apple account, no two-factor prompt required.

This is formally classified under CWE-289, a category of authentication-bypass weaknesses, and it earned a maximum-severity score.

How bad is it, really?

NVD rates CVE-2026-8457 as Critical, CVSS 9.8 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). In plain terms:

• Exploitable over the internet, no access to your network or server needed.
• Low effort for the attacker, no special conditions required.
• No privileges or login needed to attack.
• No victim interaction needed, the targeted user doesn't have to click anything.
• Full impact: an attacker can read, change, or disrupt anything the compromised account could, including a full admin takeover if they target an admin's email.

That combination, remote, trivial, and total, is why this sits at the top of the severity scale. Wordfence's writeup covers the same finding if you want a second source.

Who's affected

Per the NVD description, every version of the plugin up to and including 2.8.7 is vulnerable. The NVD record doesn't list a fixed version number, so don't assume any specific release number is safe just because it's newer than 2.8.7.

What to do right now

1. Check your version. Go to WP Admin > Plugins and find "Social Login for WooCommerce" or "WooCommerce - Social Login." Note the version number.
2. If it's 2.8.7 or earlier, go to the plugin's settings and turn off the "Sign in with Apple" option immediately. If you can't disable just that provider, deactivate the whole plugin until you've confirmed a fix.
3. Check the vendor's changelog on the CodeCanyon item page for a security update, since NVD doesn't list a fixed version number itself. Update as soon as one is available, and re-check the changelog periodically if nothing's out yet.
4. Force-expire all existing logins. The simplest way on WordPress is to change the AUTH_KEY, AUTH_SALT, SECURE_AUTH_KEY, SECURE_AUTH_SALT, LOGGED_IN_KEY, and LOGGED_IN_SALT values in wp-config.php (WordPress.org's secret-key generator will generate fresh ones). This invalidates every active session, including any an attacker may already hold.
5. Have every admin reset their password, and turn on two-factor authentication for admin accounts if you haven't already.
6. Review your user list for any administrator or editor accounts you don't recognize, especially ones created recently.
7. Check your login logs for unusual activity around the plugin's login endpoint, particularly spikes in requests right after this disclosure date (published August 2, 2026).

If any of that turns up something you don't understand, like an unfamiliar admin account or logins from unexpected countries, treat it as a possible compromise and work through our guide on what to do if your website has been hacked rather than guessing.

Why this matters beyond this one plugin

This bug is a good reminder that "social login" convenience features carry real trust decisions behind the scenes: your site is trusting a third party's token to decide who gets logged in as whom. When that verification is done sloppily, the convenience becomes the attack surface.

It's also worth running a broader check on your site, not just this plugin, since authentication bugs like this one rarely travel alone in neglected or rarely-updated plugins. A free passive security check can flag obvious exposure without needing your login credentials, and our guide on how to tell if your website is hackable walks through the common warning signs non-technical owners can actually check themselves.

Key takeaways

• CVE-2026-8457 is a critical (CVSS 9.8) authentication bypass in the "WooCommerce - Social Login" plugin's Apple Sign-In handler, affecting versions through 2.8.7.
• The plugin trusted Apple login tokens without checking their cryptographic signature, and exposed the anti-forgery nonce to the public, letting anyone log in as any existing user, including admins.
• If you run this plugin with Apple login enabled, disable that login option now and update as soon as the vendor ships a fix; the NVD record doesn't name a fixed version yet.
• After patching, rotate your WordPress secret keys to kill existing sessions, force admin password resets, and check your user list and logs for anything unfamiliar.
• If you're not sure whether something slipped through before you locked this down, a one-time manual audit is the straightforward way to find out.

If you want a second set of eyes confirming this plugin, and everything else on your site, is actually configured safely, that's exactly what a Circuit audit is for: a real person checks your whole site by hand for $49, with evidence and exact fixes, not just an automated scan rerunning the same signatures everyone else uses.