Unauthenticated Attackers Can Log in as Any Existing User on the Site

CVE-2024-9946

Summary

The Super Socializer plugin for WordPress, which facilitates social sharing and social login capabilities, is exposed to an authentication bypass vulnerability stemming from inadequate verification of users based on social login tokens. This flaw enables unauthenticated attackers to potentially log in as existing users, granted they have the user's email and that the social login does not correlate with an already existing account on the platform utilizing the returning token. While direct access to administrator accounts is not permitted by default, the risk heightens if an administrator has configured their account to permit social logins, revealing a serious oversight in user authentication processes. The vulnerability has been partially addressed in version 7.13.68.

References