Authentication Bypass Vulnerability in Login Me Now Plugin for WordPress
CVE-2025-1717
8.1HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 February 2025
What is CVE-2025-1717?
The Login Me Now plugin for WordPress has a vulnerability that allows unauthenticated attackers to bypass authentication, enabling them to log in as any existing user, including administrators. This issue arises from insecure authentication mechanisms that rely on arbitrary transient names within the 'AutoLogin::listen()' function. Although the plugin is not inherently vulnerable, its configuration can expose it to risk if transient names and values from other software are used.
Affected Version(s)
Login Me Now – Passwordless, Magic Link, OTP & Social Login for WordPress 0 <= 1.7.2