CVE-2023-2704 – The BP Social Connect WordPress plugin versions... (How to Fix)

Q: What is the severity of CVE-2023-2704?

CVE-2023-2704 has a CVSS score of 9.8 (CRITICAL). The BP Social Connect WordPress plugin versions up to 1.5 have an authentication bypass vulnerability that allows unauthenticated attackers to log in as any existing user, including administrators, if they have access to the user's email address. This occurs due to insufficient verification during Facebook login integration. All WordPress sites using vulnerable versions of this plugin are affected.

📋 TL;DR

The BP Social Connect WordPress plugin versions up to 1.5 have an authentication bypass vulnerability that allows unauthenticated attackers to log in as any existing user, including administrators, if they have access to the user's email address. This occurs due to insufficient verification during Facebook login integration. All WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:

BP Social Connect WordPress Plugin

Versions: Versions up to and including 1.5

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability requires the Facebook login feature to be enabled in the plugin configuration.

📦 What is this software?

Bp Social Connect by Vibethemes

View all CVEs affecting Bp Social Connect →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain administrative access to WordPress sites, enabling complete site takeover, data theft, malware injection, and further network compromise.

🟠

Likely Case

Attackers compromise user accounts, steal sensitive data, deface websites, or install backdoors for persistent access.

🟢

If Mitigated

With proper monitoring and limited user accounts, impact is reduced to unauthorized access to non-privileged accounts only.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires knowledge of target user email addresses, which can often be obtained through enumeration or public sources.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 1.6 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2914042%40bp-social-connect%2Ftrunk&old=1904372%40bp-social-connect%2Ftrunk&sfp_email=&sfph_mail=#file6

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find BP Social Connect plugin. 4. Click 'Update Now' if update available. 5. If no update appears, manually download version 1.6+ from WordPress repository and replace plugin files.

🔧 Temporary Workarounds

Disable Facebook Login Feature

all

Temporarily disable the vulnerable Facebook login functionality in plugin settings.

Deactivate Plugin

linux

Completely deactivate the BP Social Connect plugin until patched.

wp plugin deactivate bp-social-connect

🧯 If You Can't Patch

Disable or remove the BP Social Connect plugin immediately.
Implement strict network access controls to limit exposure to the WordPress admin interface.

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Installed Plugins for BP Social Connect version 1.5 or earlier.

Check Version:

wp plugin get bp-social-connect --field=version

Verify Fix Applied:

Confirm plugin version is 1.6 or later in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual login patterns from Facebook OAuth endpoints
Multiple failed login attempts followed by successful logins from new IPs
Administrator account logins from unexpected locations

Network Indicators:

HTTP POST requests to /wp-content/plugins/bp-social-connect/includes/social/facebook/ endpoints with manipulated parameters

SIEM Query:

source="wordpress.log" AND ("bp-social-connect" OR "facebook-login") AND (status=200 OR "login successful")

📊 Metadata

CVE ID: CVE-2023-2704

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-306

Published: May 19, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-2704, you might also want to check these: