CVE-2023-2982
First published: Thu Jun 29 2023(Updated: )
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| miniOrange WordPress Social Login and Register | <7.6.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lana.codes/lanavdb/2326f41f-a39f-4fde-8627-9d29fff91443/
- https://plugins.trac.wordpress.org/browser/miniorange-login-openid/trunk/mo-openid-social-login-functions.php#L107
- https://plugins.trac.wordpress.org/changeset/2924863/miniorange-login-openid
- https://plugins.trac.wordpress.org/changeset/2925914/miniorange-login-openid
- https://www.wordfence.com/threat-intel/vulnerabilities/id/08ca186a-2486-4a58-9c53-03e9eba13e66?source=cve
Frequently Asked Questions
What is the vulnerability ID for this WordPress plugin vulnerability?
The vulnerability ID for this WordPress plugin vulnerability is CVE-2023-2982.
What is the severity of CVE-2023-2982?
The severity of CVE-2023-2982 is critical with a score of 9.8.
Which versions of the WordPress Social Login and Register plugin are affected?
Versions up to and including 7.6.4 of the WordPress Social Login and Register plugin are affected.
What is the root cause of the vulnerability?
The root cause of the vulnerability is insufficient encryption on the user being supplied during a login validated through the plugin.
Are there any references related to this vulnerability?
Yes, you can find references related to this vulnerability at the following links: [Reference 1](https://lana.codes/lanavdb/2326f41f-a39f-4fde-8627-9d29fff91443/), [Reference 2](https://plugins.trac.wordpress.org/browser/miniorange-login-openid/trunk/mo-openid-social-login-functions.php#L107), [Reference 3](https://plugins.trac.wordpress.org/changeset/2924863/miniorange-login-openid).
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/miniorange
- canonical/miniorange wordpress social login and register