Products
WooCommerce - Social Login plugin for WordPress
- up to 2.7.3
Source
security@wordfence.com
Tags
CVE-2024-6635 details
Published : July 20, 2024, 8:15 a.m.
Last Modified : July 20, 2024, 8:15 a.m.
Last Modified : July 20, 2024, 8:15 a.m.
Description
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'woo_slg_login_email' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, excluding an administrator, if they know the email of user.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7.3 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | A product requires authentication, but the product has an alternate path or channel that does not require authentication. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
Base Score
7.3
Exploitability Score
3.9
Impact Score
3.4
Base Severity
HIGH
Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
| URL | Source |
|---|---|
| https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883 | security@wordfence.com |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/37836722-eb25-4393-8cdf-91057642ba3f?source=cve | security@wordfence.com |
This website uses the NVD API, but is not approved or certified by it.