CVE-2024-6635 is an authentication bypass vulnerability in the WooCommerce - Social Login WordPress plugin (versions ≤ 2.7.3). The issue arises from inadequate validation in the 'woo_slg_login_email' function, enabling unauthenticated attackers to impersonate any non-administrator user by supplying a known email address. This vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and has a CVSS 3.1 base score of 7.3, indicating high severity. No patch or official remediation guidance has been provided yet, and the plugin is not a cloud service.

An attacker who knows the email address of a non-administrator user can bypass authentication controls and log in as that user without credentials. This could lead to unauthorized access to user accounts, potentially exposing user data and allowing actions on behalf of the compromised user. Administrator accounts are not vulnerable to this bypass. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the WooCommerce - Social Login plugin or restricting access to trusted users only. Monitor for updates from WPWeb regarding patches or security notices.