CVE-2025-10294 is an authentication bypass vulnerability in the OwnID Passwordless Login WordPress plugin (versions up to 1.3.4). The vulnerability is due to improper validation of the ownid_shared_secret parameter before JWT-based authentication. If this value is empty, the plugin may authenticate an attacker as any user, including administrators, without credentials. This issue is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The vulnerability is remotely exploitable without privileges or user interaction and has a critical CVSS 3.1 base score of 9.8.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and gain access to any user account, including administrative accounts, on affected WordPress sites using the vulnerable OwnID Passwordless Login plugin. This can lead to full site compromise, data exposure, and administrative control takeover. The impact is high confidentiality, integrity, and availability loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid using the OwnID Passwordless Login plugin or ensure it is fully configured so that the ownid_shared_secret value is not empty. Monitoring for plugin updates and applying any official patches promptly is recommended once released.