CVE-2024-9893 is an authentication bypass vulnerability (CWE-288) in Nextend Social Login Pro plugin for WordPress, affecting all versions up to 3.1.14. The issue stems from inadequate verification of the user identity returned by the social login token, enabling attackers with knowledge of a user's email to authenticate as that user without proper authorization, provided the user does not already have an account linked to the social login service. This vulnerability allows full compromise of user accounts, including administrative accounts, due to the lack of proper authentication checks.

Successful exploitation allows unauthenticated attackers to log in as any existing user on the affected WordPress site, including administrators, leading to complete compromise of confidentiality, integrity, and availability of the site. This can result in unauthorized access, data theft, site defacement, or further malicious activities under the guise of legitimate users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable the Nextend Social Login Pro plugin or restrict its usage to trusted users only. Monitor vendor channels for updates and apply official patches immediately once available.