Security readout for executives and security teams
Plain-English summary
A flaw in the SoClever WordPress plugin can let an internet-based attacker sign in as any existing user without credentials. Under default conditions, the attacker may receive the original administrator’s session. Successful abuse could expose site data, permit content or configuration changes, and enable complete site compromise.
Executive priority
Act immediately on internet-facing installations. The flaw can provide administrator access without credentials and could lead to full site compromise. Prioritize discovery and containment today, followed by compromise assessment. No confirmed fixed version is identified in the supplied sources.
Technical view
The plugin’s publicly accessible login handler lacks authentication, authorization, and nonce validation. A remote, unauthenticated attacker can obtain a valid session for an existing account, including administrators. The source bundle identifies versions through 1.2.0 as affected and assigns CVSS 3.1 score 9.8 under CWE-287.
Likely exposure
Internet-accessible WordPress sites running this plugin through version 1.2.0 are likely exposed. Exploitation requires no privileges or user interaction and has low stated complexity. The supplied affected-product metadata is incomplete and contains a conflicting version entry, so administrators should verify the plugin name and installed version directly.
Exploitation context
The source bundle includes a WPScan reference tagged for exploit and technical information, but KEV status is false. No supplied evidence confirms active exploitation in the wild. Treat the vulnerability as readily exploitable based on its unauthenticated, network-accessible design, without assuming observed attacks.
Researcher notes
The reported weakness is missing authentication controls in a public login handler. Impact spans confidentiality, integrity, and availability. The default path reportedly yields the original administrator’s session without account details. Source metadata is inconsistent: the description says through 1.2.0, while the affected array lists version “0” with unknown default status.
Mitigation direction
- Disable and remove the affected plugin until authoritative vendor remediation guidance is available.
- Check vendor and WordPress plugin guidance for a confirmed fixed release before re-enabling it.
- Invalidate active WordPress sessions, especially administrator sessions, after containment.
- Reset privileged credentials if logs or site changes indicate possible compromise.
- Restrict administrative access and preserve relevant logs for incident investigation.
Validation and detection
- Inventory WordPress sites for the named SoClever plugin and record installed versions.
- Confirm whether each affected site exposes the plugin’s public login functionality.
- Review authentication logs for unexpected administrator sessions, locations, times, or account activity.
- Inspect administrator accounts, plugins, themes, content, and configuration for unauthorized changes.
- After remediation, confirm the plugin is absent, disabled, or updated per authoritative guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-77001 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/01c78c78-3915-44da-824a-f68074985c75/CVE reference, WPScan · exploit, vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authentication
Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.