GCVE - cpe:2.3:a:wpweb:woocommerce_-_social_login:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:wpweb:woocommerce_-_social_login:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Wpweb (`21bd5c05-5b3f-5bb1-9946-82120b0607d6`)
Product	Woocommerce Social Login (`328da7d7-3525-54a0-b5c9-28a389557612`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-7503`	vulnerable	2026-06-08 06:58:22.313058	WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover CRITICAL (9.8) The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'woo_slg_confirm_email_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the userID. This requires the email module to be enabled. Published: 2024-08-10T02:01:24.069Z Updated: 2026-04-08T17:32:57.105Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/f3b727ba-b39c-4a98-a6a6-ea33785079f6?source=cve https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-6637`	vulnerable	2026-06-08 06:58:20.058259	WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password HIGH (7.3) The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user. Published: 2024-07-20T07:37:52.405Z Updated: 2026-04-08T16:36:07.667Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/10d92d5e-1c23-4f6a-bfab-0756876190a5?source=cve https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-6636`	vulnerable	2026-06-08 06:58:20.056293	WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation CRITICAL (9.8) The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woo_slg_login_email' function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to change the default role to Administrator while registering for an account. Published: 2024-07-20T07:38:04.704Z Updated: 2026-04-08T17:01:47.344Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/77ea4ba8-6c13-494a-92e3-12643003635b?source=cve https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-6635`	vulnerable	2026-06-08 06:58:20.055010	WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass HIGH (7.3) The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'woo_slg_login_email' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, excluding an administrator, if they know the email of user. Published: 2024-07-20T07:38:03.542Z Updated: 2026-04-08T16:46:23.609Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/37836722-eb25-4393-8cdf-91057642ba3f?source=cve https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-5871`	vulnerable	2026-06-08 06:56:17.662821	WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection CRITICAL (9.8) The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'woo_slg_verify' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Published: 2024-06-15T03:35:11.306Z Updated: 2026-04-08T17:35:24.161Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd592e6-2ac4-4af4-bfc0-d4f834157d71?source=cve https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-5868`	vulnerable	2026-06-08 06:56:17.651310	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-10114`	vulnerable	2026-06-08 06:22:03.594968	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.