CVE-2024-6637: WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6637?
CVE-2024-6637 is classified as a medium severity vulnerability that allows unauthenticated privilege escalation.
How do I fix CVE-2024-6637?
To fix CVE-2024-6637, upgrade the WooCommerce - Social Login plugin to version 2.7.4 or later.
What versions are affected by CVE-2024-6637?
CVE-2024-6637 affects all versions of the WooCommerce - Social Login plugin up to and including version 2.7.3.
What type of vulnerability is CVE-2024-6637?
CVE-2024-6637 is a vulnerability that allows for unauthenticated privilege escalation due to inadequate brute force protections.
Who is impacted by CVE-2024-6637?
Any WordPress site using the WooCommerce - Social Login plugin version 2.7.3 or earlier is at risk due to CVE-2024-6637.