CVE-2026-13142 WordPress.org CVE debrief

Who should care

Administrators and users of WordPress sites utilizing the Social Login, Passkeys, Magic Link & Email OTP plugin should be aware of this vulnerability and take immediate action to protect their sites. They should review the official advisory, monitor for suspicious login attempts, and implement additional security measures to prevent brute-force attacks.

Technical summary

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext. This allows an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover. The vulnerability is caused by the lack of proper security controls in the plugin.

Defensive priority

High

Recommended defensive actions

• Update the Social Login, Passkeys, Magic Link & Email OTP WordPress plugin to version 1.4.1 or later.
• Implement additional security measures such as rate limiting and attempt lockout on passwordless email one-time-password verification.
• Monitor for suspicious login attempts and implement logging and alerting mechanisms.
• Consider using a Web Application Firewall (WAF) to detect and prevent brute-force attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-20T07:16:35.483Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 stores short numeric codes in plaintext, allowing brute-force attacks. Defenders should review the official advisory and monitor for suspicious login attempts.

Official resources