Vulnerability · Published Jun 29, 2023 · Assigned by Wordfence

CVE-2023-2982WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass

Critical 9.8

In plain English

A critical-severity authentication bypass in miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) from cyberlord92. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 46.2% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)46.2%top 1.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.

Affected products (as reported)

Vendor	Product	Versions
cyberlord92	miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)	0 – through 7.6.4

Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References