CVE-2025-3746: Privilege Escalation Vulnerability in OTP-less One Tap Sign in WordPress Plugin

Overview

The CVE-2025-3746 vulnerability affects the OTP-less One Tap Sign in plugin for WordPress, a popular content management system used by millions of websites worldwide. This vulnerability, if exploited, can lead to privilege escalation via account takeover, making it particularly harmful to any organization using vulnerable versions of the plugin. What makes this vulnerability notable is the lack of proper validation of a user’s identity before updating their details-a loophole that could potentially allow unauthorized attackers to compromise user accounts, including those of administrators.

Vulnerability Summary

CVE ID: CVE-2025-3746
Severity: Critical (9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System Compromise, Potential Data Leakage

Affected Products

Product | Affected Versions

OTP-less One Tap Sign in WordPress Plugin | 2.0.14 to 2.0.59

How the Exploit Works

The vulnerability lies in the improper validation of a user’s identity by the OTP-less one tap Sign in plugin for WordPress. This allows an unauthenticated attacker to change the email addresses of arbitrary users, including administrators, by sending a malicious request to the server. Once the email address is changed, the attacker can then initiate a password reset for the compromised account, effectively granting them access. Furthermore, the plugin returns authentication cookies in the response, which can be used by the attacker to directly access the account.

Conceptual Example Code

Below is a conceptual example of a malicious HTTP request that could potentially exploit this vulnerability:

POST /wp-admin/admin-ajax.php?action=otpl_otsi_update_email HTTP/1.1
Host: targetwebsite.com
Content-Type: application/x-www-form-urlencoded
user_id=1&new_email=attacker@evil.com

In this example, the `user_id` parameter is the ID of the user account to be attacked (with `1` commonly being the administrator’s account in WordPress), and the `new_email` parameter is the email address controlled by the attacker. If the request is successful, the targeted user’s email will be changed to the attacker’s email.