How the bypass works
Sign in with Apple hands a site a JWT identity token describing who just authenticated. The receiving site is supposed to verify that token against Apple's published public keys, which is the step that proves Apple issued it and nobody edited it in transit.
WooCommerce Social Login's Apple handler skips that check. The plugin reads the email address out of the token and trusts it. An attacker can therefore build a token containing any email address on the site, present it, and be logged in as that user.
Wordfence describes the outcome as unauthenticated attackers being able to log in as any existing WordPress user, including administrators. There is no exclusion protecting admin accounts from the path, so the highest-value account on the site is the easiest one to ask for.
Who this reaches
A CVSS 9.8 with no authentication requirement and a trivially forgeable input is the profile automated scanners go looking for, and disclosure is the starting gun rather than the finish line.
The install base is easy to underestimate. Social login is a launch-day convenience feature, switched on to reduce checkout friction and then left in place across every redesign since. Nobody opens the plugin list to admire it.
For merchants running a hosted storefront, the reflex is to check the platform and conclude there is nothing to do. The WordPress install is usually somewhere else: a blog, a campaign microsite, a landing-page build on a subdomain, frequently on a host nobody has logged into since the agency that built it moved on. That install shares a domain with the brand, and an administrator account on it is enough to serve anything from it.
What to do about it
Inventory the WordPress installs you are responsible for, then patch
Updating the obvious site is the easy half. Write down every WordPress property attached to the brand, including blogs, microsites, and anything on a subdomain, and check each for WooCommerce Social Login at 2.8.7 or below. Where you find it, go to 2.8.8 or later. Where the site turns out to be abandoned, this is a reasonable moment to decide whether it should still be online at all.