Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

WordPress OTP-less One Tap Sign-in Plugin Allows Hackers to Take Over Admin Accounts

CVE-2025-3746 · published 1 year ago
Summary

The WordPress OTP-less One Tap Sign-in plugin has a security flaw that lets hackers take over admin accounts by changing email addresses and passwords. If you use this plugin, update it to the latest version to protect your site. If you can't update, consider removing the plugin or disabling it until a fix is available.

Original advisory text
The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. This is due to the plugin not properly validating a user's...
The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. This is due to the plugin not properly validating a user's identity prior to updating their details, like email. This makes it possible for unauthenticated attackers to change arbitrary users' email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Additionally, the plugin returns authentication cookies in the response, which can be used to access the account directly.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published2 May 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-3746 · NVD
Track software like this
Free during beta