The Social Login Lite For WooCommerce plugin for WordPress suffers from an authentication bypass vulnerability (CWE-288) due to inadequate verification of user identity during the social login process. This allows attackers without any privileges to authenticate as any user on the site by supplying the victim's email address. The vulnerability affects all versions up to and including 1.6.0. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability.

An attacker can bypass authentication controls and gain unauthorized access to any user account on the affected WordPress site, including administrator accounts, if the attacker knows the email address associated with the account. This can lead to full compromise of the website, data theft, modification, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the Social Login Lite For WooCommerce plugin or restricting its use to trusted users only. Monitor for updates from the vendor phoeniixx and apply any official patches promptly once available.