Vulnerabilities / Loginizer / WPSEC-2026-2064
Loginizer <= 2.1.2 - Improper Certificate Validation in Social Login
High 7.4
CWE-295Fixed in 2.1.3
- ID
- WPSEC-2026-2064
- Plugin
- Loginizer (loginizer)
- Affected
- from 1.8.7 before 2.1.3
- Remediation
- Update to 2.1.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-295
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Loginizer on WPSec AttackSurface
- Fix released
- Published
Description
The Loginizer plugin for WordPress is vulnerable to improper certificate validation in all versions up to, and including, 2.1.2, because the bundled HybridAuth cURL client used by Social Login turned off TLS peer and host verification for requests to OAuth providers. This makes it possible for unauthenticated attackers who are in a man-in-the-middle position between the site and the provider to intercept the token exchange and forge provider profile responses. A forged response could log the attacker in as any user whose email they supply, including administrators.
References
- https://wpsec.com/vuln/WPSEC-2026-2064/
- https://plugins.svn.wordpress.org/loginizer/tags/2.1.3/
- https://wordpress.org/plugins/loginizer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS