{"id":"CVE-2026-121848","published":"2026-11-07T06:16:58.620","lastModified":"2026-11-10T16:28:46.510","description":"The Magic Link  WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/00c498cd-5319-47ed-afe6-14359bf1ee70/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Magic Link WordPress plugin before 2.2.6 lacks authorization checks when generating login links, allowing any authenticated user—including low-privileged ones like subscribers—to request and use a magic link to log in as any other user, including administrators. This enables full account takeover without requiring credentials.","exploitability":"Exploitation is trivial for any authenticated user with access to the plugin's endpoint; no special tools or privileges beyond a valid WordPress session are required.","blast_radius":"Successful exploitation grants attackers administrative-level access, enabling full site compromise including data exfiltration, malware deployment, and persistence.","remediation":"Upgrade to Magic Link version 2.2.6 or later, which includes the necessary authorization checks to prevent unauthorized magic link generation.","detection":"Defenders should monitor WordPress debug logs and access logs for repeated requests to the plugin's magic link generation endpoint (e.g., /wp-json/magic-link/v1/request) from low-privilege users (e.g., subscribers) targeting high-privilege accounts; anomalous patterns include same-user generating multiple links for different admin roles in short timeframes.","tags":["auth-bypass","wordpress","privilege-escalation","magic-link","cwe-269"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:52:50.701Z"}}