CVE-2026-77001
N/A PoC AVAILABLEThe Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.
Public exploit or PoC code exists. Modeled probability is still low, but the barrier to attack is reduced — watch closely.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 9th percentile
Impact if exploited
—CVSS · not scored
- No impact metrics
Proof of concept & exploit code
- reference https://wpscan.com/vulnerability/01c78c78-3915-44da-824a-f68074985c75/
- github-search Search GitHub for public PoC repos
Test against your own equipment
curl -s https://vulnpedia.com/cve/CVE-2026-77001/poc.jsonMachine-readable PoC index for this CVE (for automation).Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-77001/poc.json
Weakness (CWE)
Not classified.
CVSS vector
Not yet scored.