VULNERABILITY INTELLIGENCE
CVE-2026-13142
CVSS score8.1 HIGH
EPSS probability0.38%
CISA KEVNot currently listed
Published2026-07-20
Last modified2026-07-21
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.
Weakness classification
- CWE-269: Improper Privilege Management