# Loginizer <= 2.1.2 - Improper Certificate Validation in Social Login

- **ID:** WPSEC-2026-2064
- **Plugin:** Loginizer (`loginizer`), https://wordpress.org/plugins/loginizer/
- **Affected versions:** from 1.8.7 before 2.1.3
- **Fixed in:** 2.1.3 (Update to 2.1.3 or later.)
- **Severity:** High 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-295
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/loginizer
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2064/

## Description

The Loginizer plugin for WordPress is vulnerable to improper certificate validation in all versions up to, and including, 2.1.2, because the bundled HybridAuth cURL client used by Social Login turned off TLS peer and host verification for requests to OAuth providers. This makes it possible for unauthenticated attackers who are in a man-in-the-middle position between the site and the provider to intercept the token exchange and forge provider profile responses. A forged response could log the attacker in as any user whose email they supply, including administrators.

## References

- https://wpsec.com/vuln/WPSEC-2026-2064/
- https://plugins.svn.wordpress.org/loginizer/tags/2.1.3/
- https://wordpress.org/plugins/loginizer/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2064/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.