What is the CVSS score of CVE-2026-13142?

CVE-2026-13142 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Social Login (WordPress plugin) are affected by CVE-2026-13142?

The 'Social Login, Passkeys, Magic Link & Email OTP' WordPress plugin before version 1.4.1 permits unauthenticated attackers to guess one-time passwords and gain administrative access to affected…. A patch is available.

Is there a public PoC exploit available for CVE-2026-13142?

Yes, a public proof-of-concept exploit is available for CVE-2026-13142. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-13142?

Within 24 hours, identify all WordPress instances using the 'Social Login, Passkeys, Magic Link & Email OTP' plugin before version 1.4.1 and immediately apply the vendor patch to version 1.4.1 or later. Within 7 days, verify successful patch deployment across all affected sites, audit access and authentication logs for OTP brute-force attempts or unauthorized login activity, and document any suspicious access patterns. Within 30 days, conduct a post-remediation security review including credential rotation for all user accounts, forensic analysis of system changes during the exposure window, and implementation of additional protective controls such as mandatory multi-factor authentication for administrative users.

Social Login (WordPress plugin) CVE-2026-13142

EUVD-2026-45888 HIGH

Improper Privilege Management (CWE-269)

2026-07-20 WPScan

GHSA-v566-43gw-4r9h

WordPress Privilege Escalation Social Login Passkeys Magic Link Email Otp

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable, unauthenticated, no user interaction; AC:L because absent rate limiting makes short-code brute-force trivial, and success grants full admin control (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 13:23 vuln.today

CVSS changed

Jul 21, 2026 - 13:22 NVD

8.1 (HIGH)

Patch available

Jul 20, 2026 - 09:17 EUVD

CVE Published

Jul 20, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 20, 2026 - 06:00 cve.org

HIGH 8.1

DescriptionCVE.org

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.

AnalysisAI

Authentication bypass via OTP brute-force in the 'Social Login, Passkeys, Magic Link & Email OTP' WordPress plugin before 1.4.1 lets an unauthenticated attacker who knows a registered email address guess the passwordless one-time-password and log in as that user, including an administrator, resulting in full site takeover. The plugin fails to enforce rate limiting or a working lockout on OTP verification and stores the short numeric codes in plaintext, so codes can be exhausted rapidly. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.

Technical ContextAI

The affected component is a WordPress authentication plugin offering passwordless sign-in methods (social login, passkeys, magic links, and email OTP). The vulnerability lives in the email OTP flow: after a user requests a login code, the plugin emails a short numeric code and expects it back for verification. The root cause is classified as CWE-269 (Improper Privilege Management), but functionally it is an insufficient-anti-automation / weak-authentication weakness - there is no rate limiting and no effective attempt lockout on the verification endpoint, and codes are stored in plaintext rather than hashed. Because the OTP keyspace is small (short numeric codes) and unbounded guessing is permitted, the effective entropy of the authentication factor collapses. The affected CPE is cpe:2.3:a:unknown:social_login,_passkeys,_magic_link_&_email_otp with the vendor recorded as 'unknown' in the NVD/EUVD data.

RemediationAI

Vendor-released patch: upgrade the plugin to version 1.4.1 or later, which is the primary and sufficient fix. Consult the WPScan advisory (https://wpscan.com/vulnerability/a34d9be7-c121-4c95-9ebb-a14c763e16bb/) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-13142) for details. If immediate patching is not possible, temporarily disable the email OTP / passwordless login method in plugin settings and require standard password plus a separate MFA, which removes the vulnerable verification path at the cost of user convenience; place the WordPress login and REST/AJAX authentication endpoints behind a WAF or rate-limiting proxy (e.g., fail2ban or a WAF that throttles repeated OTP verification attempts per IP and per email) to blunt automated guessing, accepting that distributed sources can evade IP-based throttling; and restrict wp-admin/login access by IP allowlist or VPN where feasible. Because codes are stored in plaintext, also rotate and invalidate any outstanding OTPs after upgrading.