{
 "id": "WPSEC-2026-2064",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2064/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2064/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2064/index.md",
 "title": "Loginizer <= 2.1.2 - Improper Certificate Validation in Social Login",
 "description": "The Loginizer plugin for WordPress is vulnerable to improper certificate validation in all versions up to, and including, 2.1.2, because the bundled HybridAuth cURL client used by Social Login turned off TLS peer and host verification for requests to OAuth providers. This makes it possible for unauthenticated attackers who are in a man-in-the-middle position between the site and the provider to intercept the token exchange and forge provider profile responses. A forged response could log the attacker in as any user whose email they supply, including administrators.",
 "plugin": {
  "slug": "loginizer",
  "name": "Loginizer",
  "full_name": "Loginizer",
  "wordpress_org": "https://wordpress.org/plugins/loginizer/",
  "advisories_url": "https://wpsec.com/vuln/plugin/loginizer/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/loginizer"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-295"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.8.7",
    "from_inclusive": true,
    "to": "2.1.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.8.7 before 2.1.3"
  ]
 },
 "introduced_in": "1.8.7",
 "fixed_in": "2.1.3",
 "remediation": "Update to 2.1.3 or later.",
 "fix_released": "2026-10-29T12:59:37+00:00",
 "published": "2026-10-30T13:53:52+00:00",
 "updated": "2026-10-29T17:43:11.873010+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2064/",
  "https://plugins.svn.wordpress.org/loginizer/tags/2.1.3/",
  "https://wordpress.org/plugins/loginizer/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/loginizer",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}