CVE-2024-9946highCWE-287

CVE-2024-9946: falha de alta gravidade em the_champ Social Share, Social Login and…

Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.13.68 - Authentication Bypass via Disqus OAuth provider

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Social Share, Social Login and Social Comments Plugin – Super Socializer

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.6%
The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.13.68. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they have access to the email and the user does not have an already-existing account for the service returning the token. An attacker cannot authenticate as an administrator by default, but these accounts are also at risk if authentication for administrators has explicitly been allowed via the social login. The vulnerability was partially patched in version 7.13.68.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
the_champ · Social Share, Social Login and Social Comments Plugin – Super Socializer
CVEs relacionadas — the_champ Social Share, Social Login and…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-13230MEDIUMSocial Share, Social Login and Social Comments Plugin – Super Socializer <= 7.14 - Unauthenticated Limited SQL Injection via 'SuperSocializerKey'EPSS 0.5%CVE-2026-11798MEDIUMSocial Share, Social Login and Social Comments Plugin <= 7.14.5 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' ParameterEPSS 0.4%