CVE-2025-10294: WordPress OwnID Auth Bypass Vulnerability

CVE-2025-10294 Overview

The OwnID Passwordless Login plugin for WordPress contains a critical authentication bypass vulnerability in all versions up to and including 1.3.4. The vulnerability stems from improper validation of the ownid_shared_secret configuration value during JWT-based user authentication. When the plugin is not fully configured, attackers can exploit this flaw to authenticate as any user on the system, including administrators, without providing valid credentials.

Critical Impact

Unauthenticated attackers can bypass authentication and gain administrative access to WordPress installations where the OwnID Passwordless Login plugin has not been fully configured, potentially leading to complete site takeover.

Affected Products

• OwnID Passwordless Login plugin for WordPress versions up to and including 1.3.4
• WordPress installations with partially configured OwnID plugin instances

Discovery Timeline

• 2025-10-15 - CVE-2025-10294 published to NVD
• 2025-10-16 - Last updated in NVD database

Technical Details for CVE-2025-10294

Vulnerability Analysis

This vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The core issue lies in the plugin's failure to validate whether the ownid_shared_secret value has been properly configured before processing JWT authentication requests. When this secret is empty or unset—which occurs in newly installed or partially configured plugin instances—the JWT verification process can be bypassed entirely.

The attack requires no user interaction and can be executed remotely over the network. An attacker can craft malicious authentication requests that the plugin will accept due to the missing secret validation, allowing impersonation of any user account including those with administrative privileges.

Root Cause

The plugin does not properly verify that the ownid_shared_secret configuration value is populated before authenticating users via JWT tokens. This missing validation check creates a condition where the authentication mechanism can be circumvented when the plugin is in an unconfigured or partially configured state. The assumption that the shared secret will always be present represents a critical security oversight in the authentication flow.

Attack Vector

The vulnerability is exploitable over the network without requiring any authentication or user interaction. Attackers can target WordPress installations running vulnerable versions of the OwnID Passwordless Login plugin, particularly those that have recently installed the plugin but have not completed the configuration process. By sending specially crafted JWT authentication requests to the vulnerable endpoint, attackers can authenticate as any user including administrators.

The attack surface includes any publicly accessible WordPress installation with the vulnerable plugin installed and not fully configured. Successful exploitation grants the attacker complete access to the targeted user account, with administrator accounts providing full site control.

Detection Methods for CVE-2025-10294

Indicators of Compromise

• Unexpected authentication events in WordPress logs without corresponding user login attempts
• New administrator accounts created without authorized administrative action
• Suspicious JWT-based authentication requests in web server access logs
• Modifications to site content, plugins, or themes by unknown actors
• Unusual activity from the OwnID Passwordless Login plugin endpoints

Detection Strategies

• Monitor WordPress authentication logs for anomalous login patterns, particularly successful logins without corresponding user activity
• Implement web application firewall rules to detect and block malformed JWT authentication requests
• Audit WordPress user accounts regularly to identify unauthorized administrator accounts
• Review access logs for requests targeting OwnID plugin endpoints from suspicious IP addresses

Monitoring Recommendations

• Enable detailed logging for WordPress authentication events and plugin activity
• Configure alerts for new administrator account creation or privilege escalation
• Monitor for configuration changes to security-sensitive plugins
• Implement real-time log analysis to detect authentication bypass attempts

How to Mitigate CVE-2025-10294

Immediate Actions Required

• Verify that the ownid_shared_secret is properly configured in the OwnID Passwordless Login plugin settings
• If the plugin is not actively in use, consider temporarily deactivating it until a patch is applied
• Audit all administrator accounts to ensure no unauthorized accounts have been created
• Review recent authentication logs for signs of exploitation

Patch Information

Organizations using the OwnID Passwordless Login plugin should monitor the WordPress Plugin Directory for updated versions that address this vulnerability. The Wordfence Vulnerability Report provides additional details and tracking for this security issue.

Workarounds

• Ensure the ownid_shared_secret is configured with a strong, cryptographically random value before enabling the plugin
• Temporarily deactivate the OwnID Passwordless Login plugin if it cannot be properly configured
• Implement additional access controls at the web server level to restrict access to authentication endpoints
• Use a web application firewall with rules to detect and block authentication bypass attempts
• Enable two-factor authentication for all administrator accounts as an additional security layer

# Verify plugin configuration status in WordPress
wp option get ownid_shared_secret

# Temporarily deactivate the vulnerable plugin
wp plugin deactivate ownid-passwordless-login

# List all administrator accounts to audit for unauthorized access
wp user list --role=administrator