WordPress SoClever Social Login Plugin Unauthenticated Admin Session Access

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 has a critical security vulnerability.

WordPress plugin SoClever Social Login does not perform any authentication, authorization, or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators.

In the default case, a session as the site's original administrator account is obtained without needing to know any account details at all.