More than 30,000 WordPress sites using miniOrange’s Social Login and Register plugin could have their user accounts exposed with the exploitation of a critical authentication bypass vulnerability, tracked as CVE-2023-2982, according to The Hacker News. The flaw, which stems from a hardcoded encryption key for securing data from social media-based logins, “makes it possible for an unauthenticated attacker to gain access to any account on a site including accounts used to administer the site, if the attacker knows, or can find, the associated email address,”

Source: SC Magazine