Description
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
Published: 2023-06-29
Score: 9.8 Critical
EPSS: 70.1% High
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Apr 2026 17:00:00 +0000

Type Values Removed Values Added
Title WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
Weaknesses CWE-288

Wed, 27 Nov 2024 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Miniorange Wordpress Social Login And Register \(discord\, Google\, Twitter\, Linkedin\)
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:34:20.273Z

Reserved: 2023-05-30T13:38:43.774Z

Link: CVE-2023-2982

cve-icon Vulnrichment

Updated: 2024-08-02T06:41:03.909Z

cve-icon NVD

Status : Modified

Published: 2023-06-29T02:15:16.103

Modified: 2026-04-08T17:16:58.410

Link: CVE-2023-2982

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses