CVE-2024-9946

The Super Socializer plugin for WordPress, used for social sharing, login, and commenting, has a vulnerability that allows unauthorized attackers to bypass authentication and log in as any existing user on the site. This occurs because the plugin does not properly verify the user associated with a social login token, allowing an attacker to access a user's account if they have access to the user's email and no account for the corresponding social service already exists. While this vulnerability prevents attackers from logging in as administrators by default, administrators are still at risk if social login is enabled for their accounts.

Based on public CVE data (MITRE/NVD).