CVE-2026-16261

CVE-2026-16261 concerns the login-social WordPress plugin up to version 1.0.4. The vulnerability arises because password-reset requests are not validated against a reset key or the requester’s identity, and authentication sessions can be issued from unverified third-party sign-in data. The result...