Unauthenticated Privilege Escalation Vulnerability in WooCommerce Social Login Plugin

CVE-2024-6637

What is CVE-2024-6637?

The WooCommerce - Social Login plugin for WordPress is susceptible to unauthenticated privilege escalation across all versions up to and including 2.7.3. The vulnerability arises from insufficient brute force protections on a weak one-time password system. This flaw enables attackers to perform brute force attacks on the one-time password, granting access to the accounts of any user except for those with Administrator privileges, provided they know the targeted user's email address. This poses a significant risk to the security of user accounts within affected installations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References