Critical · published June 29, 2023
🚨 An unauthenticated attacker can log in as *any* user—yes, including your admin—just by knowing their email address. 🔥 Think of it like a party where all the guests have their badges on display, and a sneaky party-crasher walks in, looks at the badges, and just starts impersonating the VIPs. That's what this vulnerability allows! If exploited, this vulnerability could lead to an attacker gaining full access to sensitive admin features, altering settings, or even deleting content. It’s absolutely devastating and puts not just user accounts at risk, but the entire site’s integrity on the line!
Think of it like a party where all the guests have their badges on display, and a sneaky party-crasher walks in, looks at the badges, and just starts impersonating the VIPs. That's what this vulnerability allows! This authentication bypass in the WordPress Social Login and Register plugin stems from insufficient encryption of user data during login, enabling attackers to impersonate any existing user if they know their associated email address. Versions up to 7.6.4 are affected, with a partial patch in 7.6.4 and a full fix in 7.6.5.
If exploited, this vulnerability could lead to an attacker gaining full access to sensitive admin features, altering settings, or even deleting content. It’s absolutely devastating and puts not just user accounts at risk, but the entire site’s integrity on the line! Immediately update the WordPress Social Login and Register plugin to version 7.6.5 or later to close this critical vulnerability. Additionally, review your user permissions and monitor for any suspicious activity that could indicate unauthorized access. Don't wait—take action now! You've got this! Follow these steps, and you’ll have your site secured in no time. 🛡️