Executive brief
A vulnerability in a popular WordPress authentication plugin allows unauthorized individuals to take over any user account, including administrators. The plugin fails to limit the number of login attempts for its email-based one-time password (OTP) system, meaning an attacker can repeatedly guess the code until they succeed. This could lead to a total compromise of the website, data theft, and loss of administrative control.
Technical details
The vulnerability exists in the passwordless email one-time-password (OTP) verification mechanism of the VentraConnect Social Login plugin. The application fails to implement effective rate limiting or account lockout mechanisms for OTP attempts and stores these short numeric codes in plaintext within the database. An unauthenticated remote attacker who knows a registered user's email address can programmatically brute-force the OTP to gain a valid session. If the targeted email belongs to an administrator, this results in full site takeover. The issue is resolved in version 1.4.1.
Affected products
- VentraConnect Social Login, Passkeys, Magic Link & Email OTP (ventraconnect-social-login) < 1.4.1
Timeline
- 2026-06-29: disclosed: Publicly published by WPScan
- 2026-07-20: advisory: NVD publication date
- 2026-07-20: patched: Fixed in version 1.4.1