CVE-2024-9946 Auth bypass in Social Share, Social Login and Social Comments Plugin – Super Socializer
Unauthenticated attackers can log in as existing users via insufficient OAuth verification in the Super Socializer WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9946?
CVE-2024-9946 is a high-severity authentication bypass vulnerability in the_champ Social Share, Social Login and Social Comments Plugin – Super Socializer, published on 6 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.13.68. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they have access to the email and the user does not have an already-existing account for the service returning the token. An attacker cannot authenticate as an administrator by default, but these accounts are also at risk if authentication for administrators has explicitly been allowed via the social login. The vulnerability was partially patched in version 7.13.68.
Weakness: CWE-287
Which versions are affected by CVE-2024-9946?
It affects 1 product.
Products include Heateor Super Socializer.
How do I fix CVE-2024-9946?
No fix has been published for CVE-2024-9946 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-9946 being exploited?
There is no known exploitation of CVE-2024-9946 in the wild and no public exploit code.
Other vulnerabilities in the_champ Social Share, Social Login and Social Comments Plugin – Super Socializer
- CVE-2023-35882 WordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS)
- CVE-2021-24987 Super Socializer < 7.13.30 - Reflected Cross-Site Scripting
- CVE-2022-4484 Super Socializer < 7.13.44 - Contributor+ Stored XSS
- CVE-2024-13230 SQL injection in Social Share, Social Login and Social Comments Plugin – Super Socializer
- CVE-2024-2836 Super Socializer < 7.13.64 - Editor+ Stored XSS
Sources
Also known as GHSA-mgwf-rf72-8j49.