PT-2024-37766 · WordPress · Woocommerce - Social Login

Maxntv + 1 · Published 2024-07-20 · Updated 2025-02-11 · CVE-2024-6637

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WooCommerce - Social Login plugin for WordPress versions up to, and including, 2.7.3

Description The issue is related to unauthenticated privilege escalation due to a lack of brute force controls on a weak one-time password. This allows unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of the user.

Recommendations For versions up to, and including, 2.7.3, update to a version that includes brute force controls on the one-time password to prevent unauthenticated privilege escalation. As a temporary workaround, consider restricting access to the one-time password feature until a patch is available.

Fix

Weakness Enumeration

CWE-305

Related Identifiers

CVE-2024-6637

Affected Products

Woocommerce - Social Login

References · 6

• https://osv.dev/vulnerability/CVE-2024-6637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6637 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/10d92d5e-1c23-4f6a-bfab-0756876190a5?source=cve · Note
• https://t.me/cvedetector/1247 · Telegram Post
• https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883 · Note
• https://t.me/cvenotify/110840 · Telegram Post