HDWebmobile Social Login

HDWebmobile Social Login

“Continue with Google” login and signup for WooCommerce, offered alongside the normal password login — every identity token is cryptographically verified against Google’s own current public keys, issuer, audience, and expiry before any account is ever touched.

Overview

HDWebmobile Social Login adds a “Continue with Google” button to your WooCommerce login and registration forms, alongside the normal password login. Customers can sign up or sign back in with one click, without typing a password.

A competing WooCommerce social-login plugin had a critical authentication-bypass vulnerability (CVE-2026-8457, CVSS 9.8): its “Sign in with Apple” handler read the email address out of the identity token and logged the visitor straight in as the matching WordPress account — without ever verifying the token’s digital signature against Apple’s public keys. An attacker could hand-craft a token claiming to be any email address, including an administrator’s, and be logged in with zero credentials. This plugin closes that entire vulnerability class by construction: every Google identity token is cryptographically verified against Google’s own currently-published public keys (fetched live from Google’s own JWKS endpoint, never hardcoded or stale) before a single claim inside it is trusted. The token’s algorithm, issuer, audience (this site’s own Client ID), expiry, and Google’s own “email verified” flag are all independently checked, and any single failure rejects the token completely. A returning visitor is matched only by Google’s own permanent account id (sub) in a dedicated, uniquely-constrained database table — never by email. If a WordPress account already exists with the same email as a first-time Google sign-in, this plugin does not auto-link or log in — the visitor is asked to log in with their password first and connect Google from My Account, an explicit, already-authenticated opt-in.

Key Features

• “Continue with Google” button on the WooCommerce login page, next to the normal password form
• New visitors get a real WooCommerce customer account created automatically on first sign-in
• Existing customers can connect or disconnect Google from My Account > Account details
• Zero third-party libraries — token signature verification is done with PHP’s own OpenSSL functions
• The login endpoint is protected against forged cross-site submissions using Google’s own documented double-submit cookie check

Limitations

Please read before installing:

• Google only in this version — no Facebook, Apple, or other providers
• Requires a free Google OAuth Client ID from Google Cloud Console (a few minutes of one-time setup)

Quick Setup

1. Upload the plugin files to the /wp-content/plugins/hdwebmobile-social-login directory, or install through the Plugins screen directly.
2. Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
3. Create a Google OAuth Client ID in Google Cloud Console and paste it into the plugin’s settings.

Latest Version

Current stable version in readme: 1.0.0 (Initial release: Google “Continue with Google” login/signup with full JWKS signature verification, sub-based account matching, explicit opt-in linking for existing email accounts.)

See our other WordPress plugins for more WooCommerce and site-utility tools.