CVE-2024-6635

The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'woo_slg_login_email' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, excluding an administrator, if they know the email of user.

• CWE-288
• CWE-306

• https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/37836722-eb25-4393-8cdf-91057642ba3f?source=cveThird Party Advisory
• https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/37836722-eb25-4393-8cdf-91057642ba3f?source=cveThird Party Advisory

Published

Jul 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6629The All-in-One Video Gallery plugin for WordPress is vulnera…5.4
• CVE-2024-6630Rejected reason: **REJECT** This CVE ID was issued in error …
• CVE-2024-6631The ImageRecycle pdf & image compression plugin for WordPres…4.3
• CVE-2024-6632A vulnerability exists in FileCatalyst Workflow whereby a fi…7.2
• CVE-2024-6633The default credentials for the setup HSQL database (HSQLDB)…9.8
• CVE-2024-6634The Master Currency WP plugin for WordPress is vulnerable to…6.4
• CVE-2024-6636The WooCommerce - Social Login plugin for WordPress is vulne…9.8
• CVE-2024-6637The WooCommerce - Social Login plugin for WordPress is vulne…7.3
• CVE-2024-6638An integer overflow vulnerability due to improper input vali…5.5
• CVE-2024-6639The MDx theme for WordPress is vulnerable to Stored Cross-Si…6.4
• CVE-2024-6640In ICMPv6 Neighbor Discovery (ND), the ID is always 0. When…6.3
• CVE-2024-6641The WP Hardening – Fix Your WordPress Security plugin for Wo…5.3