Passwordless Email OTP Vulnerability in Social Login by WordPress
CVE-2026-13142
What is CVE-2026-13142?
The Social Login, Passkeys, Magic Link & Email OTP plugin for WordPress versions prior to 1.4.1 is vulnerable due to a lack of rate limiting and absence of lockout mechanisms for its passwordless email one-time-password verification. This oversight allows attackers to exploit the security weakness by brute-forcing the short numeric codes stored in plaintext. If they know a registered email address, malicious users could gain unauthorized access to accounts, including those with administrative privileges, which may lead to complete site compromise.
Affected Version(s)
Social Login, Passkeys, Magic Link & Email OTP 0 < 1.4.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.