7.3

CVE-2024-6637

WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password

WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password

The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user.
Mögliche Gegenmaßnahme
WooCommerce - Social Login: Update to version 2.7.4, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wpwebelite ≫ Woocommerce Social Login SwPlatformwordpress Version < 2.7.4
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WooCommerce - Social Login
Version *-2.7.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.279
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@wordfence.com 7.3 3.9 3.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-305 Authentication Bypass by Primary Weakness

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883
Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/10d92d5e-1c23-4f6a-bfab-0756876190a5?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/10d92d5e-1c23-4f6a-bfab-0756876190a5
Third Party Advisory