Unauthenticated Privilege Escalation Vulnerability in WooCommerce Social Login Plugin

CVE-2024-6637

What is CVE-2024-6637?

The WooCommerce - Social Login plugin for WordPress is susceptible to unauthenticated privilege escalation across all versions up to and including 2.7.3. The vulnerability arises from insufficient brute force protections on a weak one-time password system. This flaw enables attackers to perform brute force attacks on the one-time password, granting access to the accounts of any user except for those with Administrator privileges, provided they know the targeted user's email address. This poses a significant risk to the security of user accounts within affected installations.

References