Unauthorized Modification of Data in WooCommerce Social Login Plugin

CVE-2024-6636

What is CVE-2024-6636?

The WooCommerce - Social Login plugin for WordPress is affected by a security vulnerability that allows unauthorized data modification. This issue arises from a missing capability check on the 'woo_slg_login_email' function, which is present in all versions up to and including 2.7.3. Unauthenticated attackers can exploit this vulnerability to alter a new user's default role to Administrator during the account registration process, potentially granting them elevated privileges within the WordPress environment. This significant weakness emphasizes the need for users to ensure they are using the latest versions of the plugin and to regularly review their site security practices.

References