# Loginizer <= 2.1.2 - Unauthenticated Arbitrary Transient Overwrite via 'lz_social_login' Cookie

- **ID:** WPSEC-2026-2063
- **Plugin:** Loginizer (`loginizer`), https://wordpress.org/plugins/loginizer/
- **Affected versions:** from 1.8.7 before 2.1.3
- **Fixed in:** 2.1.3 (Update to 2.1.3 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/loginizer
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2063/

## Description

The Loginizer plugin for WordPress is vulnerable to arbitrary transient modification via the 'lz_social_login' cookie in all versions up to, and including, 2.1.2, due to insufficient validation of the cookie value, which the Social Login HybridAuth transient storage used directly as the transient name. This makes it possible for unauthenticated attackers to overwrite or create arbitrary transients with Social Login session data that expires after 60 seconds, which can disrupt features that rely on those transients. Social Login must have at least one provider configured. The 'lz_social_error' cookie was also used without validation as a site transient name.

## References

- https://wpsec.com/vuln/WPSEC-2026-2063/
- https://plugins.svn.wordpress.org/loginizer/tags/2.1.3/
- https://wordpress.org/plugins/loginizer/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2063/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.