High severity7.3NVD Advisory· Published Jul 20, 2024· Updated Jun 17, 2026
CVE-2024-6637
CVE-2024-6637
Description
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user.
Affected products
4cpe:2.3:a:wpwebelite:woocommerce_social_login:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:wpwebelite:woocommerce_social_login:*:*:*:*:*:wordpress:*:*range: <2.7.4
- (no CPE)range: 0
<=2.7.3+ 1 more
- (no CPE)range: <=2.7.3
- (no CPE)
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.