CVE-2024-7503 WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover
Unauthenticated attackers can bypass authentication and take over accounts, including administrators, if the email module is enabled and user IDs are known.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-7503?
CVE-2024-7503 is a critical authentication bypass vulnerability in WPWeb WooCommerce - Social Login, published on 10 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'woo_slg_confirm_email_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the userID. This requires the email module to be enabled.
Which versions are affected by CVE-2024-7503?
It affects 1 product.
Products include Wpwebelite Woocommerce Social Login.
How do I fix CVE-2024-7503?
No fix has been published for CVE-2024-7503 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-7503 being exploited?
There is no known exploitation of CVE-2024-7503 in the wild and no public exploit code.
Other vulnerabilities in WPWeb WooCommerce - Social Login
- CVE-2024-6636 WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation
- CVE-2024-5871 WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection
- CVE-2024-10114 Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2024-6635 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass
- CVE-2024-6637 WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password
Sources
Also known as GHSA-4q2c-288h-f42x.