CVE-2024-11087: miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypass
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11087?
CVE-2024-11087 has a high severity rating due to the authentication bypass vulnerability that can allow unauthorized access.
How do I fix CVE-2024-11087?
To fix CVE-2024-11087, update the miniOrange Social Login and Register Pro Addon plugin to version 200.3.10 or later.
Who is affected by CVE-2024-11087?
Any user of the miniOrange Social Login and Register Pro Addon plugin for WordPress in versions up to and including 200.3.9 is affected by CVE-2024-11087.
What causes CVE-2024-11087?
CVE-2024-11087 is caused by insufficient verification of the user returned by the social login, leading to potential authentication bypass.
What should I do if I cannot update due to compatibility issues with CVE-2024-11087?
If you cannot update to fix CVE-2024-11087, review your site's access controls and consider disabling social login features temporarily.