CVE-2024-10020 is an authentication bypass vulnerability in the Heateor Social Login WordPress plugin (versions up to 1.1.35). The issue arises from insufficient verification of the user identity returned by the social login token, enabling attackers with knowledge of a user's email to authenticate as that user without valid credentials. Although administrator accounts are not vulnerable by default, they may be at risk if social login authentication is enabled for those accounts. This vulnerability is classified under CWE-287 (Improper Authentication) and has a CVSS 3.1 base score of 8.1, indicating high severity.

Successful exploitation allows unauthenticated attackers to bypass authentication and log in as any existing user on the affected WordPress site, potentially leading to full compromise of user accounts. While administrator accounts are not vulnerable by default, they can be compromised if social login is enabled for those accounts, increasing the risk of site-wide control. This can result in complete confidentiality, integrity, and availability loss for the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable social login functionality or restrict its use to trusted users only. Additionally, do not enable social login authentication for administrator accounts to reduce risk. Monitor vendor channels for updates and apply patches promptly once released.