CVE-2024-10114: Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.7.7. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10114?
CVE-2024-10114 is classified as a critical vulnerability due to its potential for authentication bypass.
How do I fix CVE-2024-10114?
To fix CVE-2024-10114, update the WooCommerce - Social Login plugin to version 2.7.8 or later.
Who is affected by CVE-2024-10114?
CVE-2024-10114 affects all versions of the WooCommerce - Social Login plugin for WordPress up to and including 2.7.7.
What type of vulnerability is CVE-2024-10114?
CVE-2024-10114 is an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access.
What software does CVE-2024-10114 impact?
CVE-2024-10114 impacts the WooCommerce - Social Login plugin developed by WPWebElite for WordPress.