WordPress Magic Link Plugin Privilege Escalation Flaw

The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Magic Link WordPress plugin before version 2.2.6 contains a critical authorization bypass vulnerability that allows any authenticated user—including low-privileged accounts like subscribers—to generate valid login links for administrator accounts and gain unauthorized administrative access. This privilege escalation flaw affects WordPress sites using the vulnerable plugin versions and matters because it eliminates the need for attackers to crack passwords or bypass multi-factor authentication; instead, they simply need any valid account on the site to impersonate site administrators. Small to enterprise WordPress installations relying on this plugin for passwordless authentication are at immediate risk of complete account takeover and site compromise.

Casky's 224 mapped security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability through MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would observe findings indicating improper input validation (CWE-269) in authentication workflows, specifically detecting when authorization checks are missing before login link generation. The platform's skills would flag suspicious patterns such as: low-privileged users requesting authentication tokens for high-privileged accounts, login link generation without role-based access control validation, and account takeover attempts that bypass credential requirements. Security teams would see these detections correlated across their environment, enabling them to identify compromised subscriber accounts being weaponized to escalate privileges—critical intelligence for containing lateral movement and preventing administrative account compromise before attackers establish persistence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-121848.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-121848

Casky has 224 skills that investigate the attack patterns behind CVE-2026-121848. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn