Critical · published May 2, 2025
🚨 Unauthenticated attackers can waltz right in and change any user's email, even administrators, thanks to a sneaky flaw in the OTP-less One Tap Sign-In plugin for WordPress! 🔥 Think of this like a hotel check-in desk that lets anyone walk up and alter guest bookings without showing ID. Just one wrong move, and an attacker could change your room details and walk right in! The ramifications are absolutely devastating: an attacker could hijack administrator accounts, reset passwords, and gain full access to sensitive data, effectively turning them into the new account owner. This could lead to data leaks, unauthorized changes, or even site defacement, putting your entire site in peril!
Think of this like a hotel check-in desk that lets anyone walk up and alter guest bookings without showing ID. Just one wrong move, and an attacker could change your room details and walk right in! The vulnerability arises from the plugin's failure to properly verify user identity before allowing updates to user details. It enables unauthenticated users to change email addresses and obtain authentication cookies, granting direct account access.
The ramifications are absolutely devastating: an attacker could hijack administrator accounts, reset passwords, and gain full access to sensitive data, effectively turning them into the new account owner. This could lead to data leaks, unauthorized changes, or even site defacement, putting your entire site in peril! Immediately update the OTP-less One Tap Sign-In plugin to version 2.0.60 or later to patch this vulnerability. Implement proper identity validation mechanisms and review your user account security policies to ensure unauthorized changes cannot be made. 🛡️ You've got this! By following these steps, you'll bolster your defenses and keep your site secure. ⚡️👨💻