CVE-2023-2982: WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this WordPress plugin vulnerability?
The vulnerability ID for this WordPress plugin vulnerability is CVE-2023-2982.
What is the severity of CVE-2023-2982?
The severity of CVE-2023-2982 is critical with a score of 9.8.
Which versions of the WordPress Social Login and Register plugin are affected?
Versions up to and including 7.6.4 of the WordPress Social Login and Register plugin are affected.
What is the root cause of the vulnerability?
The root cause of the vulnerability is insufficient encryption on the user being supplied during a login validated through the plugin.
Are there any references related to this vulnerability?
Yes, you can find references related to this vulnerability at the following links: [Reference 1](https://lana.codes/lanavdb/2326f41f-a39f-4fde-8627-9d29fff91443/), [Reference 2](https://plugins.trac.wordpress.org/browser/miniorange-login-openid/trunk/mo-openid-social-login-functions.php#L107), [Reference 3](https://plugins.trac.wordpress.org/changeset/2924863/miniorange-login-openid).