CVE-2023-2704
First published: Fri May 19 2023(Updated: )
The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Social Connect | <=1.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lana.codes/lanavdb/1bd0dfd9-ffec-4d69-bc55-286751300cab/
- https://plugins.trac.wordpress.org/browser/bp-social-connect/tags/1.5/includes/social/facebook/class.facebook.php#L138
- https://plugins.trac.wordpress.org/browser/bp-social-connect/tags/1.5/includes/social/facebook/class.facebook.php#L188
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2914042%40bp-social-connect%2Ftrunk&old=1904372%40bp-social-connect%2Ftrunk&sfp_email=&sfph_mail=#file6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/44c96df2-530a-4ebe-b722-c606a7b135f9?source=cve
Frequently Asked Questions
What is the severity of CVE-2023-2704?
CVE-2023-2704 has a high severity rating due to the potential for authentication bypass allowing unauthenticated access.
How do I fix CVE-2023-2704?
To address CVE-2023-2704, update the BP Social Connect plugin to version 1.6 or later where the vulnerability is resolved.
Who is affected by CVE-2023-2704?
CVE-2023-2704 affects all users of the BP Social Connect plugin for WordPress versions up to and including 1.5.
What type of vulnerability is CVE-2023-2704?
CVE-2023-2704 is classified as an authentication bypass vulnerability.
Can CVE-2023-2704 lead to unauthorized access?
Yes, CVE-2023-2704 can allow unauthenticated attackers to gain unauthorized access to user accounts.
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/severity
- agent/author
- agent/references
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/vibethemes
- canonical/social connect
- version/social connect/1.5