CVE-2026-13142 describes an improper privilege management vulnerability (CWE-269) in the Social Login, Passkeys, Magic Link & Email OTP WordPress plugin versions prior to 1.4.1. The plugin does not enforce rate limiting or implement a working attempt lockout on its passwordless email OTP verification mechanism. Additionally, the short numeric OTP codes are stored in plaintext. An unauthenticated attacker who knows a registered email address can brute-force the OTP code to log in as that user, including administrators, resulting in full site compromise.

An attacker can gain unauthorized access to user accounts by brute-forcing the OTP codes due to missing rate limiting and plaintext storage of codes. This includes the ability to compromise administrator accounts, leading to full site takeover with confidentiality, integrity, and availability impacts rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's authentication endpoints where possible and monitor for suspicious login attempts. Avoid using affected versions in production environments if possible.