CVE-2024-4552: 
WordPress vulnerability analysis and mitigation

The Social Login Lite For WooCommerce plugin for WordPress contains an authentication bypass vulnerability (CVE-2024-4552) affecting versions up to and including 1.6.0. The vulnerability was discovered and reported by István Márton from Wordfence, with public disclosure on June 3, 2024 (NVD).

The vulnerability stems from insufficient verification of user credentials during the social login process through the plugin. The issue has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a severe security risk (Wordfence).

This vulnerability allows unauthenticated attackers to bypass authentication controls and log in as any existing user on the site, including administrators, provided they have access to the user's email address. This could lead to complete site compromise (NVD).

The vulnerability is considered highly exploitable due to its network accessibility, low attack complexity, and no required privileges or user interaction for exploitation, as indicated by the CVSS metrics (Wordfence).

Site administrators running the affected versions of Social Login Lite For WooCommerce should immediately update their installations to a patched version when available. In the meantime, considering the severity of the vulnerability, it is recommended to disable the plugin (NVD).