Loginizer <= 2.1.2 - Unauthenticated Arbitrary Transient Overwrite via 'lz_social_login' Cookie
- ID
- WPSEC-2026-2063
- Plugin
- Loginizer (loginizer)
- Affected
- from 1.8.7 before 2.1.3
- Remediation
- Update to 2.1.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Loginizer on WPSec AttackSurface
- Fix released
- Published
Description
The Loginizer plugin for WordPress is vulnerable to arbitrary transient modification via the 'lz_social_login' cookie in all versions up to, and including, 2.1.2, due to insufficient validation of the cookie value, which the Social Login HybridAuth transient storage used directly as the transient name. This makes it possible for unauthenticated attackers to overwrite or create arbitrary transients with Social Login session data that expires after 60 seconds, which can disrupt features that rely on those transients. Social Login must have at least one provider configured. The 'lz_social_error' cookie was also used without validation as a site transient name.
References
- https://wpsec.com/vuln/WPSEC-2026-2063/
- https://plugins.svn.wordpress.org/loginizer/tags/2.1.3/
- https://wordpress.org/plugins/loginizer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS