Risk Letters

Exploited vulnerability

CVE-2026-103898

TLP:CLEAR

Wpmet wp_social_login_and_register_social_counter Improper Authentication

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` with `permission_callback => __return_true` locating an existing WordPress account solely by the email string returned from the OAuth provide

Facts

  • Vendor: Wpmet
  • Product: wp_social_login_and_register_social_counter
  • CVSS: 8.1
  • EPSS (probability of exploitation within 30 days): 0.4 %
  • First known exploitation: 31 October 2026
  • First seen by Risk Letters: 1 November 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD