Critical · published October 15, 2025
🚨 An authentication bypass lurking in the OwnID Passwordless Login plugin for WordPress could turn any user into an administrator! 🔥 Think of it like a guest slipping into a VIP lounge without a proper ID check — they could access confidential conversations and make decisions without permission. This sneaky flaw lets attackers jump in without any credentials, simply by exploiting how the plugin checks its security settings. An attacker could log in as any user, including those with administrator privileges, if the plugin is improperly configured. This could lead to unauthorized access to sensitive data, changing configurations, or even deleting important content. The potential fallout is absolutely devastating for both site security and user trust!
Think of it like a guest slipping into a VIP lounge without a proper ID check — they could access confidential conversations and make decisions without permission. This sneaky flaw lets attackers jump in without any credentials, simply by exploiting how the plugin checks its security settings. This vulnerability arises from the OwnID Passwordless Login plugin failing to verify that the ownid_shared_secret value is non-empty before authenticating users via JWT, allowing unauthenticated attackers to gain access.
An attacker could log in as any user, including those with administrator privileges, if the plugin is improperly configured. This could lead to unauthorized access to sensitive data, changing configurations, or even deleting important content. The potential fallout is absolutely devastating for both site security and user trust! To protect your site, immediately update the OwnID Passwordless Login plugin to version 1.3.5 or later. Review your plugin configuration to ensure proper security settings are in place, and consider implementing additional access controls. 🛡️ You’ve got this! Follow these steps, and you’ll shore up your defenses in no time. 🦸