WP Manifestindependent plugin directory
manifest / users / hdwebmobile-social-login

HDWebmobile Social Login

Continue with Google login for WooCommerce -- every identity token is cryptographically verified before any account is touched.

by htrxuan - Han Tran · github.com/htrxuan/hdwebmobile-social-login · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/htrxuan/hdwebmobile-social-login/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/htrxuan/hdwebmobile-social-login ↗

"Continue with Google" login and signup for WooCommerce -- every identity token is cryptographically verified before any account is ever touched.

Description

HDWebmobile Social Login adds a "Continue with Google" button to your WooCommerce login and registration forms, alongside the normal password login. Customers can sign up or sign back in with one click, without typing a password.

Why this plugin exists

A competing WooCommerce social-login plugin had a critical authentication-bypass vulnerability (CVE-2026-8457, CVSS 9.8): its "Sign in with Apple" handler read the email address out of the identity token and logged the visitor straight in as the matching WordPress account -- without ever verifying the token's digital signature against Apple's public keys. An attacker could hand-craft a token claiming to be any email address, including an administrator's, and be logged in with zero credentials and zero existing access. This plugin closes that entire vulnerability class by construction:

  • Every Google identity token is cryptographically verified against Google's own, currently-published public keys (fetched live from Google's own JWKS endpoint, never hardcoded or stale) before a single claim inside it is trusted -- the exact check the vulnerable plugin skipped.
  • Algorithm, issuer, audience (this site's own Client ID), expiry, and Google's own "email verified" flag are all independently checked. Any single failure rejects the token completely.
  • A returning visitor is matched only by Google's own permanent account id (sub) in a dedicated, uniquely-constrained database table -- never by email.
  • If a WordPress account already exists with the same email as a first-time Google sign-in, this plugin does not auto-link or log in -- the visitor is asked to log in with their password first and connect Google from My Account, an explicit, already-authenticated opt-in action.
  • The login endpoint is protected against forged cross-site submissions using Google's own documented double-submit cookie check.

Features

  • "Continue with Google" button on the WooCommerce login page
  • New visitors get a real WooCommerce customer account created automatically
  • Existing customers can connect or disconnect Google from My Account > Account details
  • Zero third-party libraries -- RS256 signature verification is done with PHP's own OpenSSL functions

Limitations (v1)

  • Google only -- no Facebook, Apple, or other providers
  • Requires a free Google OAuth Client ID from Google Cloud Console

Installation

  1. Upload the plugin to /wp-content/plugins/hdwebmobile-social-login, or install through the WordPress plugins screen.
  2. Activate the plugin. WooCommerce must already be installed and active.
  3. Under WooCommerce > HDWebmobile > Social Login, create a Google OAuth Client ID as instructed and paste it in.

License

GPLv2 or later. See LICENSE.