Description
The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.
Published: 2026-07-20
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WordPress plugin Social Login, Passkeys, Magic Link & Email OTP before version 1.4.1 lacks rate limiting on its password‑based email OTP verification and stores the short numeric codes in plaintext. This is a CWE-269 weak access control vulnerability. An attacker who can obtain a user’s email address can repeatedly request a one‑time password and try all possible codes until the correct one is found, allowing the attacker to log in as that user, including administrators, achieving a full site takeover.

Affected Systems

WordPress sites running the Social Login, Passkeys, Magic Link & Email OTP plugin with a version earlier than 1.4.1.

Risk and Exploitability

The CVSS score of 8.1 reflects the severe impact. The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, but the lack of attempt lockout and plaintext code storage make brute‑force attacks technically straightforward once an email address is known. The impact is severe, granting complete control of the affected site.

Generated by OpenCVE AI on August 3, 2026 at 01:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Social Login, Passkeys, Magic Link & Email OTP plugin to version 1.4.1 or later.
  • If an upgrade is not immediately possible, disable the email OTP feature or enforce strict rate limiting on OTP requests via a security plugin or web‑application firewall.
  • Implement monitoring for repeated OTP requests and block IPs or accounts exhibiting brute‑force patterns.

Generated by OpenCVE AI on August 3, 2026 at 01:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 26 Jul 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-307
CWE-330

Tue, 21 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-307
CWE-330

Tue, 21 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 07:15:00 +0000

Type Values Removed Values Added
Description The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.
Title Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-07-21T12:29:23.688Z

Reserved: 2026-06-24T08:44:44.198Z

Link: CVE-2026-13142

cve-icon Vulnrichment

Updated: 2026-07-21T12:21:38.238Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T01:30:16Z

Weaknesses
  • CWE-269

    Improper Privilege Management