CVE-2024-4552: Social Login Lite For WooCommerce <= 1.6.0 - Authentication Bypass
The Social Login Lite For WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.6.0. This is due to insufficient verification on the user being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Social Login Lite For WooCommerceto a version that resolves this vulnerability.Fixed in 1.6.0 - Compensating control
Since the issue allows unauthenticated attackers to log in as any existing user if they have access to the email, restrict/monitor access to the WordPress account email addresses (e.g., protect mailbox access) until the plugin is remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4552?
CVE-2024-4552 has been classified as a critical vulnerability due to the potential for authentication bypass.
How do I fix CVE-2024-4552?
To fix CVE-2024-4552, update the Social Login Lite for WooCommerce plugin to the latest version beyond 1.6.0.
What systems are affected by CVE-2024-4552?
CVE-2024-4552 affects the Social Login Lite for WooCommerce plugin in versions up to and including 1.6.0.
What type of vulnerability is CVE-2024-4552?
CVE-2024-4552 is an authentication bypass vulnerability in the Social Login Lite for WooCommerce plugin.
Can unauthenticated users exploit CVE-2024-4552?
Yes, unauthenticated users can exploit CVE-2024-4552 to bypass authentication when using social login.