CVE-2024-10961: 
WordPress vulnerability analysis and mitigation

The Social Login plugin for WordPress (versions up to and including 5.9.0) contains an authentication bypass vulnerability identified as CVE-2024-10961. The vulnerability was discovered and disclosed on November 22, 2024. The issue affects the plugin's handling of social login tokens, specifically related to insufficient verification of users returned by the social login process (NVD).

The vulnerability stems from insufficient verification of users being returned by the social login token. This security flaw has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) (NVD).

The vulnerability allows unauthenticated attackers to log in as any existing user on the site, including administrators, if they have access to the email and the user does not have an already-existing account for the service returning the token (NVD).

A fix has been released in version 5.10.0 of the Social Login plugin. Site administrators are strongly advised to update to this latest version to address the vulnerability (WordPress Plugin).