CVE-2024-9501 is an authentication bypass vulnerability (CWE-288) in the roxnor Wp Social Login and Register Social Counter WordPress plugin, affecting all versions up to 3.0.7. The issue stems from inadequate verification of the user identity returned by the social login token, enabling attackers without prior authentication to impersonate any existing user on the site if they have the user's email and the user does not have an existing account with the social login provider. This can lead to full compromise of user accounts, including administrative accounts. The vulnerability is remotely exploitable without user interaction and requires no privileges.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and gain access to any existing user account on the affected WordPress site, including administrator accounts. This can lead to complete site compromise, data exposure, and unauthorized administrative actions. The CVSS score of 9.8 reflects the critical impact on confidentiality, integrity, and availability.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary measure, consider disabling the Wp Social Login and Register Social Counter plugin until a fix is released. Review user accounts for suspicious activity and restrict social login usage if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.