WooCommerce’s Apple Login Has Been Broken Since August 1 — Three Plugin Patches Hit the Payment Path This Month

digital interactive web development hero image

The E-Commerce Blind Spot in Last Week’s WordPress Security Coverage

While the community was focused on 7.0.3, 7.0.4, and the BdThemes supply chain incident, three separate WooCommerce plugin patches landed quietly in the first week of August. All three touch what security teams call the “money path” — authentication, subscriptions, and payment processing. None of them required a plugin update to exploit when the attack window opened.

The most urgent is CVE-2026-8457. It has been sitting in every WooCommerce Social Login installation through version 2.8.7 since before August 1, when Wordfence researcher Rafie Muhammad of Awesome Motive disclosed it publicly.

What CVE-2026-8457 Actually Does

WooCommerce Social Login offers one-click login through Facebook, Google, Amazon, PayPal, and Apple. The Apple login handler is where the flaw lives. When a user authenticates via Apple, Apple issues a signed identity token — an id_token — that the plugin is supposed to validate against Apple’s public keys before trusting anything in it.

The plugin does not do that. It decodes the base64 payload of the id_token, accepts whatever email address is inside it, and issues an authenticated WordPress session for whatever user account holds that email. No signature verification. No issuer, audience, or expiry claim validation. The login nonce required to invoke the Apple flow is already sitting in a localized JavaScript object on the login page, visible to anyone who loads it unauthenticated.

Combine those two failures and the attack is trivial: grab the public nonce, craft a token payload containing an admin email address, submit it. The plugin issues an admin session. No credentials. No interaction from the victim. A CVSS score of 9.8 (CWE-289, Authentication Bypass by Alternate Name) reflects that accurately.

Administrator accounts are not excluded from this path. On a WooCommerce store, admin access means order data, customer PII, stored payment configurations, and full plugin control — everything that sits behind a dashboard login.

The patch is version 2.8.8. It exists. The only question is whether your installations are on it.

The Pattern Behind the Timing

This is not an isolated disclosure. On August 5, Automattic’s internal security review produced an advisory for WooCommerce Subscriptions — every version prior to 9.1.0. The advisory used language that is unusually direct for a vendor release: “an unauthorized user could assume site control.” That is not a data exposure edge case. That is a path to admin on subscription-powered stores.

Less than twenty-four hours later on August 6, a second WooCommerce advisory covered Stripe for WooCommerce. Also found through Automattic’s internal review, also patched immediately. Both are now at fixed versions.

Three WooCommerce advisories in six days. All found and patched before confirmed external exploitation. That is a working security pipeline doing its job. It also means agencies managing WooCommerce client sites had a narrow window to apply updates before the details were public — and some of those sites almost certainly missed it.

What to Check Right Now

For the Social Login plugin specifically, version confirmation is not enough if the plugin ran below 2.8.8 after August 1. Check your server access logs for POST requests to the Apple login AJAX handler during that window. Look for admin sessions that do not correspond to recognized browser fingerprints or IP ranges. If a rogue administrator account exists that you cannot attribute, treat the installation as compromised, not merely patched.

For WooCommerce Subscriptions, the 9.1.0 update is the fix. Run wp plugin get woocommerce-subscriptions --field=version on each site. Any response below 9.1.0 needs immediate action.

For Stripe for WooCommerce, the WooCommerce Developer Blog advisory from August 6 is the reference. Run a quick post-update smoke test: live card, saved card, 3-D Secure prompt, one refund. That ten-minute sequence catches every regression on the payment path.

Agencies managing multiple WooCommerce client sites should have a documented patching timeline. Not because regulators are watching — because a WooCommerce store that processes card payments and sits on a vulnerable Social Login installation is a PCI compliance problem, not just a security one. The authentication bypass at CVSS 9.8 with zero user interaction required is exactly the class of flaw that card brand forensic investigators ask about after an incident.

The Broader Signal

Automated bots began probing WordPress sites for CVE-2026-8457 within hours of public disclosure on August 1. That is not an estimate — that is the documented pattern for every CVSS 9.x WordPress plugin vulnerability disclosed in 2026, with the exploitation window now measured in hours rather than days. WordPress reported more than 250 weekly plugin vulnerability disclosures through 2026, and 43% are exploitable without authentication.

The WooCommerce ecosystem specifically carries multiplied risk. A vulnerable plugin on a single-store installation is a contained problem. The same plugin deployed across forty client sites managed by one agency is a fleet-wide exposure the moment the CVE goes public. Inventory first, then patch. Do not start from a vulnerability feed and work backward to “do I have this plugin” — that logic is already too slow for 2026’s disclosure-to-exploit timeline.

Sources: