CVE-2024-7503

CRITICAL

WooCommerce - Social Login <= 2.7.5 - Unauthenticated Authentication Bypass via Loose Activation Code Comparison

Title source: llm
STIX 2.1

Description

The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'woo_slg_confirm_email_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the userID. This requires the email module to be enabled.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0061
EPSS Percentile 44.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-306 CWE-288
Status published
Products (2)
WPWeb/WooCommerce - Social Login < 2.7.5
wpwebelite/woocommerce_social_login < 2.7.4
Published Aug 12, 2024
Tracked Since Feb 18, 2026