CVE-2024-10020: The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to insufficient verification on the user being

high Affects social-login (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2024-11-06; advisory modified 2026-06-17.

The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to insufficient verification on the user being

Package: social-login (WordPress plugin) WordPress
Affected versions: <1.1.36
Fixed in: 1.1.36
Severity: high CVSS 8.1
Exploitation: not on CISA KEV · EPSS 1% (44.2th percentile)
Published: 2024-11-06
Source: nvd

References

CWE-287

NVD record social-login (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2024-11087 high The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon pl same package: social-login (WordPress plugin)
CVE-2024-24712 medium Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne same package: social-login (WordPress plugin)
CVE-2021-32648 KEV high Account Takeover in Octobercms same weakness: CWE-287
CVE-2018-12613 high phpMyAdmin Improper Authentication same weakness: CWE-287
CVE-2018-3810 critical Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before same weakness: CWE-287
CVE-2023-28121 critical An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an same weakness: CWE-287