CVE-2026-13142: WordPress Social Login Auth Bypass Flaw

CVE-2026-13142 Overview

CVE-2026-13142 affects the Social Login, Passkeys, Magic Link & Email OTP WordPress plugin in versions before 1.4.1. The plugin fails to enforce rate limiting or a working attempt lockout on its passwordless email one-time-password (OTP) verification flow. It also stores the short numeric codes in plaintext. An unauthenticated attacker who knows a registered email address can brute-force the OTP and authenticate as that user, including an administrator. Successful exploitation grants full site takeover on affected WordPress installations. The vulnerability is classified under [CWE-269] Improper Privilege Management.

Critical Impact
Unauthenticated attackers can brute-force short numeric OTP codes to log in as any user, including administrators, resulting in complete WordPress site compromise.

Affected Products

Social Login, Passkeys, Magic Link & Email OTP WordPress plugin versions prior to 1.4.1
WordPress sites using the plugin for passwordless authentication
Any administrator or user account with a known registered email address

Discovery Timeline

2026-07-20 - CVE-2026-13142 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-13142

Vulnerability Analysis

The plugin implements passwordless authentication using email-delivered one-time passwords. When a user requests login, the plugin generates a short numeric code and emails it to the registered address. The user then submits the code to authenticate. Because the code space is limited and the verification endpoint lacks rate limiting or a functional lockout, an attacker can iterate through the entire code space in a short window. The plugin also stores the OTP values in plaintext rather than as a cryptographic hash, which increases exposure if the database is disclosed through a separate flaw.

Root Cause

The root cause is a combination of missing controls on the OTP verification endpoint and insecure storage of authentication material. The plugin does not throttle repeated verification attempts per email, per session, or per IP address. Any attempt lockout logic that exists is not enforced. The numeric code entropy is too low to withstand automated guessing without such controls. Storing the OTP in plaintext compounds the risk by removing defense in depth.

Attack Vector

An unauthenticated remote attacker needs only a valid registered email address, such as the administrator email frequently exposed on author archives or REST endpoints. The attacker triggers OTP delivery, then submits guesses to the verification endpoint at high speed until a match is found. Because passwordless authentication accepts the code alone as proof of identity, a correct guess produces a valid session for the target account. When the account is an administrator, the attacker gains plugin, theme, and user management, enabling arbitrary PHP execution through the standard WordPress admin surface.

The vulnerability is described in prose per verified advisory sources. See the WPScan Vulnerability Advisory for technical details.

Detection Methods for CVE-2026-13142

Indicators of Compromise

High volume of POST requests to the plugin's OTP verification endpoint from a single source or distributed set of sources within a short window.
Repeated failed OTP submissions followed by a successful authentication for an administrator account.
New administrator users, modified plugin or theme files, or unexpected scheduled tasks appearing shortly after unusual login activity.
Outbound requests from wp-content/plugins or wp-content/uploads to attacker-controlled infrastructure after suspected takeover.

Detection Strategies

Inspect web server and WordPress access logs for bursts of requests targeting the plugin's verify action with varying numeric payloads.
Correlate OTP request events with subsequent successful wp_login events for the same account within seconds or minutes.
Alert on privileged account logins that are not preceded by the user's typical geolocation, user agent, or device fingerprint.

Monitoring Recommendations

Enable and centralize WordPress authentication logs and web server logs in a SIEM or data lake for correlation.
Monitor changes to the wp_users and wp_usermeta tables, particularly role escalations to administrator.
Track file integrity for wp-content/plugins, wp-content/themes, and the WordPress core directories.

How to Mitigate CVE-2026-13142

Immediate Actions Required

Update the Social Login, Passkeys, Magic Link & Email OTP plugin to version 1.4.1 or later on every affected WordPress site.
Force a password reset and OTP re-enrollment for all administrator accounts and audit the user list for unauthorized additions.
Review recent authentication logs for signs of brute-force activity against the OTP endpoint and invalidate active sessions where suspicious activity is found.

Patch Information

The vendor addressed CVE-2026-13142 in version 1.4.1 of the plugin. The fix introduces rate limiting and a functional attempt lockout on OTP verification and removes plaintext storage of verification codes. Site operators should update through the WordPress plugin manager or by deploying the updated package from the plugin's official distribution. Refer to the WPScan Vulnerability Advisory for the authoritative fix reference.

Workarounds

Deactivate and remove the plugin until the site can be updated to version 1.4.1 or later.
Restrict access to WordPress login and OTP verification endpoints using a web application firewall rule that enforces per-IP and per-email request rate limits.
Obscure administrator email addresses by disabling REST user enumeration and hiding author archives to reduce the pool of viable brute-force targets.

bash

# Example nginx rate limit for the OTP verification endpoint
limit_req_zone $binary_remote_addr zone=otp_verify:10m rate=5r/m;

location = /wp-admin/admin-ajax.php {
    limit_req zone=otp_verify burst=5 nodelay;
    include fastcgi_params;
    fastcgi_pass php_upstream;
}