This critical vulnerability in the Social Login, Passkeys, Magic Link & Email OTP plugin allows unauthenticated attackers to perform a full site takeover through brute-force attacks.

The plugin fails to enforce rate limiting or lockout mechanisms on its passwordless email verification process, and it stores numeric codes in plaintext. This vulnerability is accessible to unauthenticated attackers, who can brute-force codes to hijack any user account, including administrator accounts.

The ability for an unauthenticated attacker to compromise administrative accounts poses a severe risk to organizational data integrity, confidentiality, and site availability. With a CVSS score of 8.1, this high-severity flaw represents a significant threat to business operations, as it could lead to unauthorized data exfiltration, malicious content injection, or complete loss of control over the WordPress environment.

Immediate Action: Update the Social Login, Passkeys, Magic Link & Email OTP plugin to version 1.4.1 or later immediately.

Proactive Monitoring: Review web server and application logs for repeated, failed attempts to access password verification endpoints or spikes in authentication requests from single IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block excessive requests to the plugin's authentication endpoints and consider temporarily disabling the plugin if an immediate update is not feasible.

Public Exploit Available: Unknown

Given the potential for total site takeover, this vulnerability must be treated with high priority. Organizations using this plugin should verify their current version and apply the 1.4.1 patch as a matter of urgency to prevent unauthorized access and potential data compromise.