CVE-2024-10097: Loginizer Authentication Bypass Vulnerability

CVE-2024-10097 Overview

CVE-2024-10097 is an authentication bypass vulnerability affecting the Loginizer Security and Loginizer plugins for WordPress in all versions up to and including 1.9.2. The flaw resides in the social login token handling logic, which performs insufficient verification of the user identity returned by the social login provider. Unauthenticated attackers can log in as any existing WordPress user, including administrators, provided they know the target user's email address and the targeted account has not yet been linked to the social login service returning the token. The vulnerability is classified under CWE-287: Improper Authentication.

Critical Impact
Unauthenticated attackers can impersonate administrators on affected WordPress sites, leading to full site takeover, content modification, and persistent backdoor installation.

Affected Products

Loginizer Security plugin for WordPress (versions ≤ 1.9.2)
Loginizer plugin for WordPress (versions ≤ 1.9.2)
WordPress sites with social login functionality enabled via Loginizer

Discovery Timeline

2024-11-05 - CVE-2024-10097 published to NVD
2024-11-06 - Last updated in NVD database

Technical Details for CVE-2024-10097

Vulnerability Analysis

The Loginizer plugin provides social login functionality that allows WordPress users to authenticate using third-party identity providers. The vulnerable logic resides in the social login flow defined in social-login.php, which processes tokens returned by external services. When the plugin receives a social login token, it extracts the associated email address and locates the matching WordPress account. However, the plugin fails to verify that the authenticated provider identity is actually bound to that WordPress user account.

An attacker who knows the email address of a target user, such as a site administrator, can initiate a social login flow using their own attacker-controlled account on the social provider but supplying the victim's email. The plugin matches the supplied email to the local WordPress user and grants a session for that account. The published advisory and patch are available in the WordPress Plugin Changeset 3173657.

Root Cause

The root cause is improper authentication ([CWE-287]). The plugin trusts the email field returned by the social provider as sufficient evidence of identity, without confirming that the WordPress user has previously linked their account to that provider or that the provider has verified ownership of the email. This breaks the security boundary between authentication and account lookup.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. The attacker requires only the target's email address and the absence of a pre-existing social login linkage on the targeted account. Conditions reduce reliability somewhat, since the victim user must not already have an existing account on the social login service that the attacker uses. The vulnerable source path is documented in the Loginizer plugin source code.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Intelligence entry for additional technical context.

Detection Methods for CVE-2024-10097

Indicators of Compromise

Successful WordPress administrator logins originating from the social login callback endpoint without prior account linkage events in the database.
Unexpected new posts, plugin installations, or user role changes performed by administrator accounts shortly after a social login redirect.
Authentication log entries showing social login completions for users who have never previously enrolled a social provider.

Detection Strategies

Audit the WordPress wp_users and wp_usermeta tables for administrator accounts that authenticated through Loginizer social login without corresponding linkage metadata.
Inspect web server access logs for repeated requests to the Loginizer social login callback URL followed by privileged administrative actions.
Correlate session creation events with the originating IP address and User-Agent to identify session anomalies on privileged accounts.

Monitoring Recommendations

Enable WordPress audit logging plugins that record authentication events, role changes, and plugin or theme modifications.
Forward WordPress and web server logs to a centralized log management or SIEM platform for retention and alerting on privileged login anomalies.
Alert on administrative actions performed within minutes of any first-time social login completion.

How to Mitigate CVE-2024-10097

Immediate Actions Required

Update the Loginizer Security and Loginizer plugins to the version released in changeset 3173657, which is any release after 1.9.2.
Force a password reset and invalidate active sessions for all administrator and editor accounts on affected WordPress sites.
Review administrator account inventory and remove any accounts created or modified after the plugin became vulnerable.

Patch Information

The Loginizer maintainers released a fix in WordPress Plugin Changeset 3173657. Site administrators should upgrade to the latest released version available from the Loginizer vendor site or the WordPress plugin directory. Verify the installed version via the WordPress admin Plugins screen after applying the update.

Workarounds

Disable the social login feature in the Loginizer plugin settings until the patched version is installed.
Deactivate and remove the Loginizer plugin entirely if social login is not required for the site.
Restrict access to the WordPress login and social login callback endpoints using a web application firewall or IP allowlisting until patching is complete.

bash

# Update Loginizer to the patched version using WP-CLI
wp plugin update loginizer

# Verify the installed version is greater than 1.9.2
wp plugin get loginizer --field=version

# If patching cannot be performed immediately, deactivate the plugin
wp plugin deactivate loginizer