CVE-2024-6635: WooCommerce Social Login Auth Bypass Flaw

CVE-2024-6635 Overview

CVE-2024-6635 is an authentication bypass vulnerability in the WooCommerce - Social Login plugin for WordPress, developed by wpwebelite. The flaw exists in the woo_slg_login_email function, which performs insufficient identity verification before establishing an authenticated session. Unauthenticated attackers who know a valid user email address can log in as that user. The vulnerability affects all plugin versions up to and including 2.7.3. Administrator accounts are explicitly excluded from the bypass, but any non-administrative account, including customers and shop managers, remains exposed. The issue is tracked under CWE-288 (Authentication Bypass Using an Alternate Path) and CWE-306 (Missing Authentication for Critical Function).

Critical Impact
Remote unauthenticated attackers can impersonate any non-administrator WordPress account using only the target's email address.

Affected Products

wpwebelite WooCommerce - Social Login plugin for WordPress, versions up to and including 2.7.3
WordPress sites running WooCommerce with the affected Social Login plugin enabled
E-commerce storefronts relying on the plugin for customer authentication flows

Discovery Timeline

2024-07-20 - CVE-2024-6635 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6635

Vulnerability Analysis

The vulnerability resides in the woo_slg_login_email function, which is exposed through the plugin's social login workflow. The function accepts an email address parameter and authenticates the corresponding WordPress user without validating whether the request originated from a verified social identity provider. No nonce check, token verification, or proof-of-possession is enforced against the supplied email address. An attacker submits a crafted request containing the email of a target user. The plugin issues a valid WordPress session for that account, granting access to the order history, stored payment metadata, profile information, and any WooCommerce capabilities held by the impersonated user. Only accounts with the administrator role are blocked from this code path.

Root Cause

The root cause is missing authentication for a critical function, classified under [CWE-306]. The woo_slg_login_email handler trusts client-supplied input as sufficient evidence of identity. The social login flow was designed to consume verified identity tokens from external providers, but the email-based entry point bypasses that token exchange entirely.

Attack Vector

The attack vector is network-based and requires no authentication, no user interaction, and low complexity. The attacker must know or guess a valid registered email address, which is often discoverable from public author archives, order confirmation leaks, customer reviews, or breach databases. The attacker sends an HTTP request to the vulnerable plugin endpoint with the target email as a parameter. The server responds with valid session cookies for the impersonated account.

No verified exploit code is publicly available. Technical details are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-6635

Indicators of Compromise

POST or GET requests to plugin endpoints invoking woo_slg_login_email with an email parameter and no associated OAuth state token
Successful WordPress login events without a corresponding social provider callback in access logs
New session cookies issued to user IDs from source IP addresses with no prior account history
Unexpected changes to customer profile data, shipping addresses, or order activity for non-administrator accounts

Detection Strategies

Review web server access logs for requests targeting the Social Login plugin's AJAX or REST endpoints invoking the woo_slg_login_email action
Correlate WordPress authentication events with upstream identity provider callbacks; logins lacking a matching OAuth handshake are suspicious
Inventory WordPress installations for the wpwebelite Social Login plugin and confirm versions against 2.7.3

Monitoring Recommendations

Forward WordPress authentication and WooCommerce order events to a centralized SIEM for correlation across user sessions and source IPs
Alert on multiple successful logins for different user accounts originating from a single source IP within a short window
Monitor for enumeration of customer email addresses via the WordPress REST API, author archives, or /wp-json/wp/v2/users endpoints

How to Mitigate CVE-2024-6635

Immediate Actions Required

Update the WooCommerce - Social Login plugin to a version later than 2.7.3 as soon as the vendor releases a patched build
Deactivate and remove the plugin if a patched version is not yet available and the social login feature is not business-critical
Force a password reset and invalidate all active sessions for non-administrator accounts on affected sites
Audit recent WooCommerce orders, profile changes, and stored payment activity for signs of account takeover

Patch Information

At the time of NVD publication, the vendor listing is available on CodeCanyon. Verify the installed plugin version exceeds 2.7.3 before considering the site remediated. Refer to the Wordfence advisory for the latest fixed version information.

Workarounds

Place a Web Application Firewall rule in front of WordPress that blocks requests invoking the woo_slg_login_email action from unauthenticated sources
Restrict access to the plugin's login endpoints by IP allowlist on staging or low-traffic deployments until a patch is installed
Enforce two-factor authentication for all WordPress and WooCommerce accounts to limit the impact of session impersonation
Disable the Social Login plugin and rely on native WooCommerce authentication until the vendor confirms a fix

bash

# Example WAF rule (ModSecurity) to block the vulnerable action
SecRule ARGS:action "@streq woo_slg_login_email" \
    "id:1006635,phase:2,deny,status:403,\
    msg:'Block CVE-2024-6635 WooCommerce Social Login auth bypass'"