Login Sign Up

CVE-2024-5868

6.5 MEDIUM
Authentication Bypass

📋 TL;DR

The WooCommerce Social Login plugin for WordPress has a vulnerability that allows unauthenticated attackers to bypass email verification due to insufficiently random activation codes. This affects all WordPress sites using this plugin up to version 2.6.2. Attackers could potentially create unauthorized accounts or take over existing ones.

💻 Affected Systems

Products:
  • WooCommerce Social Login WordPress Plugin
Versions: All versions up to and including 2.6.2
Operating Systems: Any OS running WordPress
Default Config Vulnerable: ⚠️ Yes
Notes: Affects all WordPress installations using the vulnerable plugin version with social login enabled.

📦 What is this software?

Woocommerce Social Login by Wpwebelite

View all CVEs affecting Woocommerce Social Login →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers create administrative accounts, compromise user data, or take over the entire WordPress site through privilege escalation.

🟠

Likely Case

Attackers create spam accounts, bypass registration controls, or perform account takeover of existing users.

🟢

If Mitigated

Limited impact with proper monitoring and account verification controls in place.

🌐 Internet-Facing: HIGH
🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

The vulnerability is simple to exploit as it requires no authentication and involves predictable activation codes.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.6.3 or later

Vendor Advisory: https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'WooCommerce Social Login' and update to version 2.6.3 or later. 4. Verify the update completed successfully.

🔧 Temporary Workarounds

Disable Social Login Plugin

all

Temporarily disable the vulnerable plugin until patched.

wp plugin deactivate woocommerce-social-login

Enable Two-Factor Authentication

all

Add additional authentication layer for user accounts.

🧯 If You Can't Patch

  • Implement web application firewall rules to block suspicious registration attempts
  • Enable detailed logging for user registration and authentication events

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Installed Plugins for WooCommerce Social Login version 2.6.2 or earlier.

Check Version:

wp plugin get woocommerce-social-login --field=version

Verify Fix Applied:

Verify plugin version is 2.6.3 or later in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

  • Unusual registration patterns
  • Multiple failed verification attempts from same IP
  • Successful logins without proper email verification

Network Indicators:

  • Spike in registration requests
  • Unusual traffic to registration endpoints

SIEM Query:

source="wordpress" AND (event="user_registration" OR event="login") AND status="success" AND verification="bypassed"

📊 Metadata

CVE ID: CVE-2024-5868
CVSS v3 Score: 6.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published: June 15, 2024
Last Updated: February 7, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON