CVE-2024-5868: WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness
The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
woocommerce-social-login/wordpress-pluginto a version that resolves this vulnerability.Fixed in 2.6.2Patch WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5868?
CVE-2024-5868 is considered a high-severity vulnerability due to the potential for unauthenticated attackers to bypass email verification.
How do I fix CVE-2024-5868?
To fix CVE-2024-5868, update the WooCommerce - Social Login plugin to version 2.6.3 or later.
What versions of WooCommerce Social Login are affected by CVE-2024-5868?
CVE-2024-5868 affects all versions of WooCommerce - Social Login up to and including 2.6.2.
Who can exploit CVE-2024-5868?
CVE-2024-5868 can be exploited by unauthenticated attackers, making it easy to bypass email verification.
What component of the WooCommerce Social Login is vulnerable in CVE-2024-5868?
CVE-2024-5868 vulnerabilities lie in the insufficient randomness of the activation code used for email verification.