A critical security vulnerability identified as CVE-2026-103898 has been discovered within the wp_social_login_and_register_social_counter plugin, a tool developed by Wpmet for the WordPress ecosystem. The flaw, which was formally reserved on October 1, 2026, and published on October 31, 2026, has reportedly been subject to active exploitation attempts immediately upon its public disclosure.
The vulnerability is currently tracked by commercial research entities, which flagged the issue as being actively exploited on the same day the CVE record was made public. While the reports of exploitation are linked to security databases and vulnerability monitoring services, there is currently no corroboration from major government-backed catalogs. Specifically, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the European Union Agency for Cybersecurity (ENISA) have not yet included this specific vulnerability in their respective Known Exploited Vulnerabilities (KEV) lists.
The classification of this event as an active exploit relies on data aggregated by private security research firms. Because the evidence of exploitation is derived from a single source catalog, the extent and nature of the threat remain unverified by broader industry consensus. The vulnerability tracking record indicates that the window between the publication of the CVE and the first reported sighting of exploitation was effectively zero days, suggesting that threat actors may have been prepared to leverage the flaw as soon as technical details became available.
The wp_social_login_and_register_social_counter plugin is designed to facilitate social media authentication and engagement tracking for WordPress sites. Security researchers have pointed to the plugin's architecture as the focal point for the vulnerability, though specific technical details regarding the exact nature of the flaw—such as whether it involves unauthorized access, data injection, or remote code execution—have not been fully detailed in the current documentation.
Users of the Wpmet plugin are advised to monitor official channels for security patches. Given the reports of rapid exploitation, administrators should treat the vulnerability as a high-priority concern. The lack of inclusion in official government KEV catalogs does not necessarily indicate a lack of danger, but rather reflects the current state of incident reporting and the time required for official agencies to validate and catalog emerging threats.
The timeline of CVE-2026-103898 highlights the ongoing challenge of "day-zero" exploitation, where the public release of a vulnerability identifier and its associated technical description provides sufficient information for attackers to develop or deploy exploit code. In this instance, the 30-day gap between the reservation of the CVE and its public disclosure did not prevent immediate exploitation upon the release of the advisory.
Security teams managing WordPress environments should verify their plugin versions and ensure that all components are updated to the latest available releases provided by Wpmet. If a patch is not yet available, administrators should consider disabling the affected functionality or implementing additional web application firewall rules to mitigate potential unauthorized activity targeting the social login and counter features.
As of early November 2026, the situation remains fluid. Further investigation by the security community is expected to clarify the scope of the exploitation and provide more concrete guidance for remediation. Organizations relying on this plugin for user authentication should remain vigilant for anomalous login patterns or unauthorized administrative actions that could indicate a compromise stemming from this vulnerability.
