CVE-2024-6637 is an authentication bypass vulnerability in the WooCommerce - Social Login WordPress plugin (up to version 2.7.3). The issue stems from a weak one-time password mechanism lacking brute force controls, enabling unauthenticated attackers to brute force OTPs for any user except administrators if the attacker knows the user's email address. This flaw allows privilege escalation by gaining unauthorized access to user accounts. The vulnerability is classified under CWE-305 (Authentication Bypass by Primary Weakness) and has a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). There is no indication of known exploits in the wild or an official patch at this time.

Successful exploitation allows unauthenticated attackers to brute force one-time passwords for any non-administrator user account if the email is known, leading to unauthorized access and privilege escalation. This can result in confidentiality, integrity, and availability impacts on affected WordPress sites using the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the WooCommerce - Social Login plugin or restricting access to it. Monitoring for unusual login attempts targeting non-administrator accounts may help detect exploitation attempts.