Log in Start free

Vulnerability · Published Feb 27, 2025 · Assigned by Wordfence

CVE-2025-1717Login Me Now <= 1.7.2 - Authentication Bypass

High 8.1

In plain English

A high-severity authentication bypass in Login Me Now – Passwordless, Magic Link, OTP & Social Login for WordPress from pluginly. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 51.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen()' function. This makes it possible for unauthenticated attackers to log in an existing user on the site, even an administrator. Note: this vulnerability requires using a transient name and value from another software, so the plugin is not inherently vulnerable on it's own.

Affected products (as reported)

VendorProductVersions
pluginly Login Me Now – Passwordless, Magic Link, OTP & Social Login for WordPress 0 – through 1.7.2

Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References