CVE-2023-2982criticalexplotación observadaCWE-288

CVE-2023-2982: fallo crítico en cyberlord92 miniOrange Social Login and…

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear miniOrange Social Login and Register

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

99Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 9.8epss 46%
de la publicación al armael mismo día
Publicada en NVD29 jun
1ª PoC29 jun
VulnCheck+172d
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
cyberlord92 · miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — cyberlord92 miniOrange Social Login and…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-12761CRITICALminiOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP FlowEPSS 0.9%CVE-2024-11087HIGHminiOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication BypassEPSS 0.5%