CVE-2024-6635 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass

What is CVE-2024-6635?

CVE-2024-6635 is a high-severity authentication bypass vulnerability in WPWeb WooCommerce - Social Login, published on 20 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'woo_slg_login_email' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, excluding an administrator, if they know the email of user.

Weakness: CWE-306, CWE-288

Which versions are affected by CVE-2024-6635?

It affects 1 product.

Products include Wpwebelite Woocommerce Social Login.

How do I fix CVE-2024-6635?

No fix has been published for CVE-2024-6635 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-6635 being exploited?

There is no known exploitation of CVE-2024-6635 in the wild and no public exploit code.

Other vulnerabilities in WPWeb WooCommerce - Social Login

• CVE-2024-7503 WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover Critical 9.8
• CVE-2024-6636 WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation Critical 9.8
• CVE-2024-5871 WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection Critical 9.8
• CVE-2024-10114 Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider High 8.1
• CVE-2024-6637 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fw5j-h477-4x76.