CVE-2024-5871: WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection
The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'wooslgverify' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/woocommerce-social-loginto a version that resolves this vulnerability.Fixed in 2.6.2Patch WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection - Configuration
Ensure the 'woo_slg_verify' vulnerable parameter used by the WooCommerce - Social Login plugin is not populated with untrusted input (block/ignore attacker-controlled values) to prevent PHP Object Injection via deserialization of that parameter.
WordPress (WooCommerce - Social Login plugin) woo_slg_verify parameter handling = untrusted input disabled/blocked
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5871?
CVE-2024-5871 is classified as a high severity vulnerability due to its potential for remote code execution via PHP Object Injection.
How do I fix CVE-2024-5871?
To fix CVE-2024-5871, update the WooCommerce - Social Login plugin to version 2.6.3 or later.
Who is affected by CVE-2024-5871?
CVE-2024-5871 affects all versions of the WooCommerce - Social Login plugin up to and including 2.6.2.
Can CVE-2024-5871 be exploited remotely?
Yes, CVE-2024-5871 can be exploited remotely by unauthenticated attackers through the deserialization of untrusted input.
What type of vulnerability is CVE-2024-5871?
CVE-2024-5871 is a PHP Object Injection vulnerability, which can lead to unauthorized code execution.