CVE-2026-16261
Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover
CVSS Score
7.5
EPSS Score
0.2%
EPSS Percentile
9th
The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as any existing account, including administrators, and take over the site.
| Vendor | unknown |
| Product | login-social |
| Published | Aug 2, 2026 |
| Last Updated | Aug 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown login-social
Be the first to know when new high vulnerabilities affecting unknown login-social are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / login-social
0 ≤ 1.0.4
References
Credits
Khaled Alenazi (Nxploited) WPScan