CVE-2026-121848

Summary

The Magic Link WordPress plugin before 2.2.6 lacks authorization checks when generating login links, allowing any authenticated user—including low-privileged ones like subscribers—to request and use a magic link to log in as any other user, including administrators. This enables full account takeover without requiring credentials.

Exploitability

Exploitation is trivial for any authenticated user with access to the plugin's endpoint; no special tools or privileges beyond a valid WordPress session are required.

Blast radius

Successful exploitation grants attackers administrative-level access, enabling full site compromise including data exfiltration, malware deployment, and persistence.

Detection

Defenders should monitor WordPress debug logs and access logs for repeated requests to the plugin's magic link generation endpoint (e.g., /wp-json/magic-link/v1/request) from low-privilege users (e.g., subscribers) targeting high-privilege accounts; anomalous patterns include same-user generating multiple links for different admin roles in short timeframes.

Prioritized remediation

Upgrade to Magic Link version 2.2.6 or later, which includes the necessary authorization checks to prevent unauthorized magic link generation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.