CVE-2024-7503 is an authentication bypass vulnerability in the WooCommerce - Social Login WordPress plugin (up to version 2.7.5). The issue stems from loose comparison of the activation code in the 'woo_slg_confirm_email_user' function, allowing unauthenticated attackers to impersonate any existing user if they know the userID and the email module is enabled. This vulnerability enables full compromise of affected sites, including administrative access. The CVSS 3.1 score is 9.8 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

Successful exploitation allows unauthenticated attackers to bypass authentication and log in as any user, including administrators, leading to full site compromise. This impacts confidentiality, integrity, and availability of the affected WordPress site. The vulnerability requires the email module to be enabled and knowledge of a valid userID. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the WooCommerce - Social Login plugin or the email module if feasible to reduce risk. Monitor official WPWeb communications for updates and apply patches promptly once available.