PT-2024-39959 · WordPress · Super Socializer

Wesley · Published 2024-11-05 · Updated 2024-11-08 · CVE-2024-9946

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Super Socializer plugin for WordPress versions up to, and including, 7.13.68

Description The issue is due to insufficient verification on the user being returned by the social login token, making it possible for unauthenticated attackers to log in as any existing user on the site if they have access to the email and the user does not have an already-existing account for the service returning the token. By default, an attacker cannot authenticate as an administrator, but these accounts are also at risk if authentication for administrators has explicitly been allowed via the social login.

Recommendations For versions up to, and including, 7.13.68, update to a version later than 7.13.68 to fully resolve the issue, as version 7.13.68 only partially patches the vulnerability. As a temporary workaround, consider restricting social login access to minimize the risk of exploitation until a fully patched version is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-9946

Affected Products

Super Socializer

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-9946 · Security Note
• https://plugins.trac.wordpress.org/changeset/3180581 · Patch
• https://osv.dev/vulnerability/CVE-2024-9946 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3172935 · Note
• https://twitter.com/VulmonFeeds/status/1854242690679951795 · Twitter Post
• https://t.me/latest_high_impact_cve/1457 · Telegram Post
• https://t.me/cvenotify/100770 · Telegram Post
• https://t.me/cvedetector/9993 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c394b8b6-b7f6-4ba7-8a2b-98160cc286a8?source=cve · Note
• https://twitter.com/CVEnew/status/1854054682517487690 · Twitter Post