The OwnID Passwordless Login plugin for WordPress is vulnerable because it does not verify that the ownid_shared_secret value is set before validating a JWT. This oversight allows an unauthenticated attacker to supply a forged token and gain access as any user, including administrators. The consequence is full control over the site without requiring credentials, compromising confidentiality, integrity, and availability of the WordPress installation.

Affecting the OwnID Passwordless Login WordPress plugin, all releases up to and including version 1.3.4 are vulnerable. Users running these versions without full configuration that sets a non‑empty ownid_shared_secret are at risk.

The flaw scores a CVSS of 9.8, indicating a critical severity. The EPSS score is less than 1%, suggesting the probability of exploitation is currently low but not zero. The vulnerability is not listed in CISA KEV. The most likely attack vector is a remote attacker exploiting the plugin’s authentication endpoint by sending a crafted JWT, bypassing the missing secret check to impersonate any user. Once authenticated, the attacker can perform any administrative actions permitted by the compromised role.