CVE-2026-16261

The CVE concerns the WordPress plugin login-social (v1.0.4) which does not validate password-reset requests against a reset key or the requester’s identity. It issues authentication sessions from unverified third‑party sign‑in data, enabling unauthenticated attackers to either reset any user’s pa...