CVE-2026-13142
Description
The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.
Metadata
Severity & Metrics
No CVSS data available.
Affected products (1)
| Vendor | Product | Platform | Versions |
|---|---|---|---|
| Unknown | Social Login, Passkeys, Magic Link & Email OTP | — | 0 < 1.4.1 |
Weakness (CWE)
| CWE | Source | Description |
|---|---|---|
| — | cna | CWE-269 Improper Privilege Management |