blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2024-6637

HIGH 7.3 CVSS 3.1
Published
July 20, 2024
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
security@wordfence.com
Weakness
CWE-305
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Description

The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user.

Affected products and versions

  • WPWeb WooCommerce - Social Login — Up to and including 2.7.3
  • yithemes yith_woocommerce_social_login — Up to and including 2.7.3
  • wpwebelite woocommerce_social_login — Before 2.7.4

References

  • codecanyon.net https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883 Product
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/10d92d5e-1c23-4f6a-bfab-0756876190a5?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record