Critical severity · published Oct 26, 2024
CVE-2024-9501
Wp Social Login and Register Social Counter <= 3.0.7 - Authentication Bypass via WordPress.com OAuth provider
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.0.7. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Wp Social Login and Register Social Counter · roxnor
through 3.0.7 · source: vendor
Affected product
WS
Wp Social Login and Register Social Counter
roxnor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9501
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9501
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wp-social/tags/3.0.6/inc/admin-create-user.php#L205
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3173675/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/a4294f5f-d989-4b97-88ee-4e94f4f7845a?source=cve
More from Wp Social Login and Register Social Counter
6.4
CVE-2026-97344
Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
5.3
CVE-2025-13620
Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering
5.3
CVE-2024-1763
Wp Social Login and Register Social Counter <= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status Update
4.3
CVE-2025-1506
Wp Social Login and Register Social Counter <= 3.1.0 - Cross-Site Request Forgery to Settings Update