{"vulnerability": "cve-2026-8457", "sightings": [{"uuid": "cacb08dd-78c9-4e54-a679-ca4f87ab1409", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8457", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms2ooi32xk2b", "content": "CVE-2026-8457 - woocommerce - social login\nAn attacker can log in to any WordPress account, including administrator accounts, without a password. This is because a vulnerable plugin is not properly checking the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wpweb #CVE #infosec", "creation_timestamp": "2026-08-02T00:04:05.554434Z"}, {"uuid": "901ccc06-4a5d-4579-b98a-b9a8ff33bc4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8457", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms2rtff4e32p", "content": "\ud83d\udd34 CVE-2026-8457 - Critical (9.8)\n\nThe WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-8457/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-02T01:00:32.046747Z"}, {"uuid": "d1dfe0ad-6175-4bd0-b26c-b804b5e1e9a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8457", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117023324641535536", "content": "CVE-2026-8457: WPWeb WooCommerce - Social Login (<=2.8.7) suffers CRITICAL auth bypass. Forged Apple id_tokens + exposed nonce = attacker can access any WordPress user, even admins. Disable Apple login or plugin ASAP. https://radar.offseq.com/threat/cve-2026-8457-cwe-289-authentication-bypass-by-alternate-name-in-wpweb-woocommerce-social-login-6bb1cfa7304c2708 #OffSeq #WordPress #Vuln", "creation_timestamp": "2026-08-02T01:30:27.247982Z"}, {"uuid": "5af032f0-e562-4559-bfe4-4e017c364a3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8457", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3ms2tix7ur22o", "content": "WPWeb WooCommerce - Social Login (<=2.8.7) has a CRITICAL auth bypass (CVE-2026-8457): attackers can impersonate any WordPress user, incl. admins. Disable Apple login or the plugin until patched. https://radar.offseq.com/threat/cve-2026-8457-cwe-289-authentication-bypass-by-alternate-name-in-wpwe...", "creation_timestamp": "2026-08-02T01:30:29.103303Z"}]}