Unauthenticated Attackers Can Bypass Authentication and Access Existing User Accounts

CVE-2024-4393

Summary

The Social Connect plugin for WordPress is affected by an authentication bypass vulnerability due to inadequate verification of the OpenID server during the social login process. This flaw impacts versions up to and including 1.2, enabling unauthenticated attackers to gain access as any existing user, including those with administrative privileges, provided they have access to the user's email address. This vulnerability poses a significant risk to WordPress sites using this plugin, emphasizing the need for users to update to a secure version promptly.

References