CVE-2024-6637: The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is…

PriorityP347high7.3CVSS 3.1

AVNACLPRNUINSUCLILAL

EPSS

0.36%

28.1th percentile

The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
wpweb	woocommerce_social_login	<= 2.7.3	—
wpwebelite	woocommerce_social_login	< 2.7.4	2.7.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.