CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.
Explanation of Vulnerability in Simple Terms
WooCommerce - Social Login versions 2.6.2 and earlier use weak random number generation for security tokens. An attacker can predict or brute-force authentication tokens without needing valid credentials, potentially gaining unauthorized access to user accounts. The vulnerability requires network access but no user interaction.
What an attacker can do
Predict or brute-force authentication tokens to gain unauthorized access to user accounts.
Potential impact on your site
User accounts may be compromised if attackers predict social login tokens, risking account takeover and data exposure.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
