Social Login (WordPress plugin) CVE-2026-13142

Exploitation requires the vulnerable plugin (before 1.4.1) to be installed and active with the email one-time-password (passwordless) login method enabled, and that the attacker knows a valid registered email address for a target account (an administrator address for full takeover). The attacker must be able to trigger an OTP for that address and send many verification attempts; success depends on the absence of rate limiting/lockout and the short numeric code length. Limiting factors: the attacker must know a registered email (mild recon, not authentication), the email OTP feature must be in use, and although PR:N (unauthenticated) the assigner's AC:H rating reflects guessing effort - yet the description's 'no rate limiting or working lockout' implies guessing is far easier than typical AC:H suggests.

Signals are mixed and should be weighed carefully. The CVSS 3.1 base score is 8.1 (High) with AV:N/AC:H/PR:N/UI:N - network-reachable, unauthenticated, no user interaction, but High attack complexity reflecting brute-force effort and the need to know a valid registered email. Impact is maximal (C:H/I:H/A:H) because success yields administrator access and full site control. Publicly available exploit code exists, raising practical risk. However, EPSS is only 0.14% (3rd percentile) and the CVE is NOT on the CISA KEV list, indicating no confirmed active exploitation and suggesting opportunistic rather than mass exploitation so far. There is tension between the low EPSS and the public POC plus critical impact: the low EPSS likely reflects the niche footprint of this specific plugin rather than difficulty of exploitation. Note a mild inconsistency worth verifying - the description characterizes the flaw as trivial brute-force (no rate limiting), which argues for lower attack complexity than the assigner's AC:H; the AC:H appears to account for the email-knowledge prerequisite. Net: a real priority for any site actually running this plugin, but limited blast radius across the broader ecosystem.

An attacker learns a registered account's email address (e.g., an admin address published on the site or harvested from author pages), triggers an email OTP login request for that address, then scripts rapid guesses against the verification endpoint. With no rate limiting or lockout and only a short numeric code to guess, the attacker exhausts the keyspace and authenticates as the administrator, gaining full control. Publicly available exploit code lowers the skill barrier to carry this out.