This vulnerability in the login-social WordPress plugin gives attackers two independent paths to full account takeover — and having both in the same plugin means you cannot rely on either authentication pathway as a trust anchor. The first flaw allows bypassing WordPress's password reset protection by injecting custom authentication logic into a flow that should be protected by cryptographic token verification. The second flaw accepts identity assertions from social providers (Google, Facebook, etc.) without verifying the cryptographic binding between the external identity and the WordPress user record — the plugin essentially trusts whatever the identity provider sends without confirmation.
The CVSS 7.5 rating obscures the real risk because it treats these as separate technical vulnerabilities rather than a single authentication architecture failure. More critically, this vulnerability enables deterministic targeting: an attacker can reset any user's password — including administrators — without guessing, enumerating, or chaining exploits. On a WordPress site, admin accounts typically hold API keys for connected services, database credentials, payment processor configurations, and email marketing integrations. Compromising the admin doesn't just mean owning the WordPress installation; it means pivoting into the site's entire operational infrastructure.
Verify whether your environment includes this plugin. If it does, update to the patched version immediately. Because the vulnerability affects both inbound (social login) and outbound (password reset) authentication paths, disabling one vector does not mitigate the other — patching is the only reliable remediation. Treat any delay in applying this update as a critical exposure window, because the compound nature of this failure means a single unpatched instance exposes the entire site's authentication model.