Passwordless Email OTP Brute-Force and Plaintext Storage Flaw

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability affects the Social Login, Passkeys, Magic Link & Email OTP WordPress plugin versions before 1.4.1, exposing a critical authentication bypass through two compounding weaknesses: the absence of rate limiting on OTP verification attempts and storage of one-time passwords in plaintext. An unauthenticated attacker with knowledge of a registered email address can systematically brute-force the short numeric codes without facing lockout restrictions, ultimately gaining unauthorized access to user accounts—including administrator accounts—and achieving full site takeover. The impact is severe because WordPress administrators control plugins, themes, content, and user data, making this a direct path to complete website compromise.

Casky's security skills leverage Claude AI's extended reasoning to detect the attack patterns mapped to MITRE ATT&CK technique TA0004 (Privilege Escalation), identifying both the brute-force enumeration phase and the unauthorized access outcome. Practitioners using Casky would recognize findings including: repeated failed OTP verification requests from a single source (indicating brute-force attempts), successful authentication following suspicious request patterns, plaintext OTP values in application logs or database queries, and privilege escalation indicators showing attacker transitions from unauthenticated to administrator sessions. The 224 mapped security skills enable detection across the attack chain—from reconnaissance (identifying active email addresses) through exploitation (OTP brute-forcing) to post-compromise actions—providing practitioners with comprehensive visibility into both preventive controls and behavioral anomalies that signal active exploitation of this vulnerability.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13142.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-13142

Casky has 224 skills that investigate the attack patterns behind CVE-2026-13142. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn