CVE-2024-5871

The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'woo_slg_verify' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

• CWE-502
• CWE-502

• https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd592e6-2ac4-4af4-bfc0-d4f834157d71?source=cveThird Party Advisory
• https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd592e6-2ac4-4af4-bfc0-d4f834157d71?source=cveThird Party Advisory

Published

Jun 15, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5865Vulnerability in Delinea Centrify PAS v. 21.3 and possibly o…6.5
• CVE-2024-5866Vulnerability in Delinea Centrify PAS v. 21.3 and possibly o…4.3
• CVE-2024-5867The Delicate theme for WordPress is vulnerable to Stored Cro…5.4
• CVE-2024-5868The WooCommerce - Social Login plugin for WordPress is vulne…5.3
• CVE-2024-5869The Neighborly theme for WordPress is vulnerable to Stored C…5.4
• CVE-2024-5870The Tweaker5 theme for WordPress is vulnerable to Stored Cro…5.4
• CVE-2024-5872On affected platforms running Arista EOS, a specially crafte…6.5
• CVE-2024-5873Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-5874IrfanView PNT File Parsing Out-Of-Bounds Write Remote Code E…7.8
• CVE-2024-5875IrfanView SHP File Parsing Out-Of-Bounds Write Remote Code E…7.8
• CVE-2024-5876IrfanView PSP File Parsing Heap-based Buffer Overflow Remote…7.8
• CVE-2024-5877IrfanView PIC File Parsing Out-Of-Bounds Write Remote Code E…7.8