CVE-2024-6635: The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient…

PriorityP349high7.3CVSS 3.1

AVNACLPRNUINSUCLILAL

EPSS

0.40%

32.1th percentile

The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'woo_slg_login_email' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, excluding an administrator, if they know the email of user.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
wpweb	woocommerce_social_login	<= 2.7.3	—
wpwebelite	woocommerce_social_login	< 2.7.4	2.7.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.