CVE-2024-6636 is a critical missing authorization vulnerability (CWE-862) in the WooCommerce - Social Login WordPress plugin, affecting all versions up to 2.7.3. The vulnerability arises from the lack of a capability check in the 'woo_slg_login_email' function, which processes user registration. This allows unauthenticated attackers to escalate privileges by setting their default role to Administrator during registration, potentially leading to full site compromise. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No patch or official fix has been documented at this time.

Successful exploitation enables unauthenticated attackers to gain administrator privileges on affected WordPress sites using the vulnerable plugin. This can lead to complete site takeover, including unauthorized data access, modification, and disruption of service. The critical CVSS score of 9.8 reflects the high risk and potential damage from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the WooCommerce - Social Login plugin or restricting access to registration endpoints if possible. Monitor the WPWeb vendor site and trusted security sources for updates and apply patches promptly once available.