Automation Web Platform CVE-2026-77264

The plugin must be installed and active with its email-OTP / magic-login flow enabled and the handle_email_otp_return() endpoint publicly reachable (the default for this login feature), and the attacker must know the email address of the target account. There are no authentication or user-interaction requirements (PR:N/UI:N). The primary limiting factor is knowledge of a valid target email address - trivial for admins exposed via user enumeration but a real constraint where email addresses are not discoverable - and the requirement that the affected version (≤ 4.8.6) with the OTP feature actually be in use rather than a non-OTP configuration.

This is a genuine top-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) aligns cleanly with the described mechanics: fully remote, no authentication, no user interaction, and full administrative account takeover. The only real precondition - knowing a target user's email address - is a low bar for admin accounts, which are frequently enumerable via author archives, REST API user endpoints, or public site content. No CISA KEV listing and no POC are reported, so this is not confirmed as actively exploited; however, the simplicity of the flaw (read a token from an HTTP response) means weaponization would be trivial and mass-scanning of WordPress plugins is common, so any operator running this plugin should treat patching as urgent rather than waiting for exploitation evidence. EPSS was not provided in the input, so probabilistic exploitation scoring cannot be cited here.

An attacker identifies an administrator's email address via the WordPress REST users endpoint or author archive pages, then sends a crafted OTP/magic-login request to the plugin's public endpoint for that email. Because the response includes the secret login token, the attacker reads it directly from the HTTP reply and replays it to authenticate as the administrator, gaining full site control. No POC is reported, but the network vector and low complexity (AC:L, no user interaction) make the attack straightforward to script.