Description
The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Magic Link | < 2.2.6 | 2.2.6 |
References
- https://wpscan.com/vulnerability/00c498cd-5319-47ed-afe6-14359bf1ee70/ exploit vdb-entry technical-description