Forged Apple login takes over WordPress admin: CVE-2026-8457 +2 flaws

On August 1, 2026, three WordPress plugins were disclosed with security flaws. The most dangerous one sits in a plugin that lets shoppers register and log in with Sign in with Apple. It is tracked as CVE-2026-8457, and its severity score (CVSS) is 9.8 out of 10 — critical. Someone who knows none of your passwords can walk in as the site administrator.

The other two (CVE-2026-18352 and CVE-2026-13339) let a visitor who is not logged in read files off the server. Both score 7.5. Fixed versions exist for all three, so the whole job is an update.

What ties them together: all three plugins exist to decide who gets in and who gets stopped. The front door and the lock of a membership site broke on the same day.

The three flaws at a glance

All three were published by Wordfence, the WordPress security firm, and landed in the US government vulnerability database NVD the same day. None of them require an account or a password on the attacker's side. Knowing the site's address is enough to try.

Who goes after this, and what they do with it

The people who hunt for holes like these are operators who sweep the open internet, hammering WordPress sites one after another and harvesting whichever ones let them in. This is rarely a targeted campaign against one company. Newly published advisories get folded straight into automated crawlers, which then collect every site still running an affected version. Membership shops, paid content sites and internal document libraries pay the most, because they hold something behind the login.

What happens next depends on the flaw. With the first one, which hands over the administrator account, an attacker will create a private admin account as a back door, swap the payment destination on checkout pages, or plant code that pushes malware at visitors. The two file-reading flaws are used for a quieter purpose: pulling the site's configuration file, which holds the database address, its password, and the secret strings that protect login sessions.

The damage does not stop at the operator. Member names, addresses and order histories all live in that database, and once the connection details are out, the whole set can be lifted. Ordinary visitors get pushed toward fake login screens on tampered pages, or handed files they never asked for. That is why checking your installed version comes before anything else.

The three flaws in detail

CVE-2026-8457: a forged Apple sign-in makes anyone an administrator (Social Login)

The plugin is Social Login – WordPress / WooCommerce Plugin, a commercial add-on from WPWeb (WP Web Elite) sold on the CodeCanyon marketplace. It costs $39 and has 3,564 recorded sales. Paired with WooCommerce, it puts "Log in with Google", "Log in with Facebook" and "Sign in with Apple" buttons on the registration screen.

The break is in the Apple path. When a shopper taps Sign in with Apple, Apple issues an electronic voucher (a token) stating that this person is who they claim to be, and the site reads it to identify the member. That voucher carries Apple's digital signature so it cannot be faked. According to the NVD entry, versions 2.8.7 and earlier never checked the signature at all — they simply decoded the readable part. They also skipped the checks on who issued it, who it was addressed to, and whether it had expired.

On top of that, the single-use token (a "nonce") needed to reach that code was printed into the page markup where any visitor could copy it. Public nonce plus unverified voucher is a fatal combination: an attacker writes the administrator's email address into a voucher they built themselves, submits it, and is logged in as the administrator. CVSS rated confidentiality, integrity and availability impact all "high", for a total of 9.8.

The finder was Rafie Muhammad of Awesome Motive, a well-known name in WordPress security research. The vendor was notified on July 14, 2026, shipped 2.8.8 on July 27, and the details went public on August 1. The vendor's own changelog records it as fixed and improved validation of Apple Sign-In ID tokens.

Of the three, this is the one that takes real work to patch. Because it is sold on CodeCanyon rather than distributed through the official WordPress plugin directory, no update badge appears in the dashboard — which is exactly how a copy stays on an old version for years.

CVE-2026-18352: the members-only file delivery hands out any file on the server (User Access Manager)

User Access Manager restricts posts, pages and attachments to specific member groups. Written by Alexander Schneider, it runs on more than 10,000 sites and has passed 1.32 million total downloads.

To stop members-only PDFs from being grabbed by direct URL, the plugin serves files through a uamgetfile parameter, and that is where the permission check was supposed to happen. In 2.3.15 and earlier, however, the permission check ran against a legitimate attachment while the file actually streamed back was the one the attacker named. The two never had to match, so a visitor with no account could read any file on the server.

The first target in this class of flaw is always wp-config.php, the file WordPress is built on. It carries the database host, username and password, plus the secret strings that protect login sessions. Once it is read, the contents of the site are effectively portable.

The fix is 2.3.16; the current release is 2.3.17. Supakiad S. (m3ez) of the Thai firm E-CQURITY reported it, and the patched tag went out roughly ten hours after notification. The fix resolves the real location of the file just before sending it and confirms that location sits inside the uploads folder. Note that this plugin had a busy July: 2.3.13, 2.3.14 and 2.3.15 each closed separate access-restriction problems.

CVE-2026-13339: slider arrow icons become a file reader (CubeWP Framework)

CubeWP Framework is a no-code toolkit for building job boards, real-estate listings and directory sites — anything built around searching and filtering posts. Written by Imran Tauqeer, it runs on over 4,000 sites with about 97,000 total downloads.

The hole was in the feature that swaps the previous/next arrow icons on an image slider. The parameters naming the icon file (prev_icon / next_icon) were passed straight into the internal reader cubewp_get_svg_content, and a chain of ../ segments climbing out of the directory was never blocked. Here too the required nonce sat in the page markup, so any visitor could try it. The reach, and the file worth stealing, are the same as above.

The fix is 1.1.31, released July 29, 2026. Nhien Pham (nhienit) of GalaxyOne reported it, and the vendor changelog names both the CVE and the researcher. The same release also closed a SQL injection, a flaw exposing other users' data, and a script-injection issue in the editor. If you are on 1.1.30 or earlier, there are reasons to update beyond this one CVE.

Why skipping a signature check hands over the admin account

The mechanics of the first flaw are worth walking through, because any site with social login is standing on the same ground.

Behind "Sign in with Apple" and "Log in with Google" sits a data format called a JWT. A JWT has three parts separated by dots. The first two hold statements — issued by Apple, addressed to this site, the user's email is this — and those parts are not encrypted; anyone can read them as-is. The third part is the digital signature, which proves the statements really came from Apple and were not edited on the way.

A JWT is not a way to hide the contents. It is a way to prove the contents are genuine, via the signature. So the receiving side has to fetch Apple's public key, verify the signature, then confirm the issuer, the audience and the expiry. Apple's developer documentation spells this out.

The plugin skipped all of it and trusted the readable part. Reading only the readable part is like being handed an ID card, ignoring the photo and the watermark, and copying down the name field. An attacker assembles a JWT-shaped string, writes the administrator's address into the email field, and is waved through.

This mix-up is not a one-off. In July 2026 a WordPress plugin handling Microsoft account sign-in was found with the same missing token validation. We have covered a comparable case before, in the miniOrange SAML SSO flaw that let anyone take over an administrator without a password. The more a component outsources your login, the more everything depends on whether it actually checks the signature it is handed.

How to check whether you are affected, and what to do

This takes a few minutes. In the WordPress dashboard, open Plugins → Installed Plugins and look for the names in the table below. If you find one, compare the version shown underneath it against the fixed version.

The two from the official directory are a single click in the Updates screen, and if you have auto-updates on they may already be fixed. Social Login is the awkward one: you need the purchasing account to pull 2.8.8 from your CodeCanyon downloads and swap the files by hand. If the person who bought it has left, or an agency built the site and you have no access, switching the Sign in with Apple button off is a workable stopgap.

After updating, check two things. First, whether an administrator account you do not recognise has appeared in the user list. Second, if you were running either file-reading flaw, rotate your secrets. Assume wp-config.php was read: change the database password and reissue the authentication keys (SALTs). Managing weaknesses in the components you pull in from outside is the subject of our open-source supply chain checklist.

Exploitation status: confirmed vs. unconfirmed

Here is what can be stated and what cannot. A calm update is enough at this stage, but that is not a reason to leave an affected version running.

That said, WordPress plugin flaws routinely get wired into automated scanners within days of disclosure. We have covered the payment-tampering batch published on July 29 and the AI Engine flaw that silently creates an administrator in quick succession. Whether real attacks start showing up can be tracked on our CISA KEV dashboard.

Two more from the same day, outside WordPress

August 1 brought two other entries worth flagging. Neither touches ordinary consumers directly, but if you are in the affected seat they are hard to ignore.

The first is CVE-2026-18556 in N-able N-central, the software companies use to manage fleets of PCs and servers remotely. The vendor's own record calls it an unauthenticated administrative account takeover, scores it 8.2, and lists every version through 2026.1 as affected. A full day after publication, though, there is still no vendor notice naming a fixed build. The only reference on file is the status page, which says nothing about it. This product had two entries added to the US catalog of actively exploited flaws in August 2025, so it is not one to sit on. Affected companies will need to ask the vendor directly.

The second is a set of four flaws in Guardian, a widely used login library for the Elixir language (CVE-2026-55735 and others). The one rated 8.2 involves the logout path decoding a token without verifying its signature, letting anyone force someone else's session to be revoked. That is the same missing-signature pattern as the first WordPress flaw above, disclosed on the same day in a different language ecosystem. The fix is 2.4.1.

One more from the same batch, CVE-2026-17002, was withdrawn by GitLab, the body that assigned it, and carries no vulnerability details.

Summary

The three WordPress plugin flaws disclosed on August 1, 2026 all sit at the point where a site decides who gets through. The worst of them, CVE-2026-8457, never verified the digital signature on the identity voucher Apple issues, so a forgery carrying the administrator's email address walks in as the administrator. The other two turn a members-only file delivery route and a slider icon setting into a way to read files off the server.

The job is to check the dashboard for these three plugins and move to the fixed versions. The two from the official directory take a few clicks. The paid one from CodeCanyon is the problem, because no update badge ever appears and you have to trace the purchase account and swap the files yourself. The plugin that never shows an update button is the one most likely to still be running the old code — that is the lesson worth keeping from this batch. We will update this article if exploitation reports or a KEV listing appear.

Sources

• ▸ NVD - CVE-2026-8457 Detail (Social Login)
• ▸ NVD - CVE-2026-18352 Detail (User Access Manager)
• ▸ NVD - CVE-2026-13339 Detail (CubeWP Framework)
• ▸ Wordfence Intelligence - WooCommerce Social Login vulnerabilities
• ▸ Wordfence Intelligence - User Access Manager vulnerabilities
• ▸ Wordfence Intelligence - CubeWP Framework vulnerabilities
• ▸ WP Web Elite - Social Login changelog (2.8.8)
• ▸ WordPress.org - User Access Manager plugin page
• ▸ WordPress.org - CubeWP Framework plugin page
• ▸ Apple Developer - Verifying a User (Sign in with Apple)
• ▸ YesWeHack - Auth bypass in WordPress Azure AD SSO plugin due to missing OIDC id_token validation
• ▸ NVD - CVE-2026-18556 Detail (N-able N-central)
• ▸ Erlang Ecosystem Foundation - CVE-2026-55735 (ueberauth Guardian)
• ▸ CISA - Known Exploited Vulnerabilities Catalog