Threats tagged 'ghsa-g8pp-vmv3-x6hw'

The Wp Social Login and Register Social Counter plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 3.2.2. The flaw arises because the plugin's social login REST callback endpoint allows unauthenticated attackers to log in as any existing WordPress user by presenting an OAuth provider email that matches the target user's registered email. The verification intended to confirm email authenticity is ineffective for Facebook and Twitter adapters, enabling attackers to bypass password checks and gain full authenticated sessions without local credentials or prior access.