Authentication bypass vulnerability in Core plugin

CVE-2024-7781

Summary

The Jupiter X Core plugin for WordPress contains a vulnerability that allows unauthenticated users to bypass authentication through the Social Login widget. This issue affects all versions up to and including 4.7.5, enabling attackers to log in as the first user who previously used a social media account, potentially taking control of administrator accounts. Notably, the exploitation can occur even if the Social Login feature is currently disabled, provided it was enabled and used in the past. The vulnerability was addressed partially in version 4.7.5 and fully resolved in version 4.7.8.

References