PT-2024-39435

Name of the Vulnerable Software and Affected Versions Wechat Social login plugin for WordPress versions up to, and including, 1.3.0 Description The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the convert remoteimage ...

CVE-2024-9108: Unrestricted Upload of File with Dangerous Type

The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convertremoteimagetolocal' function in versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

WordPress Wechat Social login Plugin <= 1.3.0 is vulnerable to Broken Authentication

Software Wechat Social login Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9106 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 26efb59ee707 Credits Istvá...

CVE-2024-9106: Authentication Bypass Using an Alternate Path or Channel

The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verification on the user being supplied during the social login. This makes it possible for unauthenticated attackers to log in as any existing...