CVE-2026-13142 describes an improper privilege management vulnerability (CWE-269) in the Social Login, Passkeys, Magic Link & Email OTP WordPress plugin versions prior to 1.4.1. The plugin fails to implement rate limiting or effective attempt lockout mechanisms on its passwordless email OTP verification process. Furthermore, the short numeric OTP codes are stored in plaintext, enabling an attacker who knows a valid email address to brute-force the OTP and authenticate as that user. This includes the possibility of logging in as an administrator, which can lead to complete control over the affected WordPress site.

An unauthenticated attacker can brute-force the plaintext-stored OTP codes due to lack of rate limiting and lockout, allowing unauthorized login as any user with a known email address. This includes administrator accounts, which can result in full site compromise and takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the affected plugin or restricting access to trusted users only. Monitor for vendor updates regarding patches or official mitigations.