PT-2024-16703 · WordPress · Sign In With Google

Khayal Farzaliyev + 1 · Published 2024-12-12 · Updated 2024-12-12 · CVE-2024-11015

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sign In With Google plugin for WordPress versions up to, and including, 1.8.0

Description The issue is due to the authenticate user function not implementing sufficient null value checks when setting the access token and user information. This allows unauthenticated attackers to log in as the first user who has signed in using Google OAuth, potentially the site administrator.

Recommendations For versions up to, and including, 1.8.0, update to a version that fixes the authentication bypass issue. As a temporary workaround, consider disabling the authenticate user function until a patch is available. Restrict access to the Google OAuth sign-in feature to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-11015

Affected Products

Sign In With Google

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-11015 · Security Note
• https://t.me/cvenotify/103975 · Telegram Post
• https://t.me/cvedetector/12705 · Telegram Post
• https://t.me/latest_high_impact_cve/1634 · Telegram Post
• https://plugins.trac.wordpress.org/browser/sign-in-with-google/trunk/src/admin/class-sign-in-with-google-admin.php#L525 · Note
• https://twitter.com/CVEnew/status/1867171928626098675 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/afe894b0-5e91-4aa2-bbd1-1f74274701cf?source=cve · Note