WordfenceVULNRICHMENT:CVE-2024-5868CVE-2024-5868 WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.9 Medium
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
17.1%
The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.
CNA Affected
[
{
"vendor": "WPWeb",
"product": "WooCommerce - Social Login",
"versions": [
{
"status": "affected",
"version": "*",
"versionType": "semver",
"lessThanOrEqual": "2.6.2"
}
],
"defaultStatus": "unaffected"
}
]Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.9 Medium
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
17.1%