CVE-2024-10020

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they have access to the email and the user does not have an already-existing account for the service returning the token. An attacker cannot authenticate as an administrator by default, but these accounts are also at risk if authentication for administrators has explicitly been allowed via the social login.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Nov 6, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-100219.8A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as critical. Affected by this issue is some unkCVE-2024-100229.8A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an unknown part of the fCVE-2024-100238.8A vulnerability classified as critical was found in code-projects Pharmacy Management System 1.0. This vulnerability affects unknown code ofCVE-2024-100248.8A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. This issue affects some uCVE-2024-100259.1A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaiCVE-2024-100265.3A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address aCVE-2024-100274.8The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high priCVE-2024-100287.5The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive InformationCVE-2024-100296.1In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.CVE-2024-10038.8A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this issue is the fuCVE-2024-100315.4In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the unCVE-2024-100325.4In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.