WP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow

Description

The plugin does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.
Where the address matches no account, one is created and signed in regardless of the site's registration setting. The affected code path is only registered on single-site installations.