Overview
The CVE-2025-3746 vulnerability affects the OTP-less One Tap Sign in plugin for WordPress, a popular content management system used by millions of websites worldwide. This vulnerability, if exploited, can lead to privilege escalation via account takeover, making it particularly harmful to any organization using vulnerable versions of the plugin. What makes this vulnerability notable is the lack of proper validation of a user’s identity before updating their details-a loophole that could potentially allow unauthorized attackers to compromise user accounts, including those of administrators.
Vulnerability Summary
CVE ID: CVE-2025-3746
Severity: Critical (9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System Compromise, Potential Data Leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
OTP-less One Tap Sign in WordPress Plugin | 2.0.14 to 2.0.59
How the Exploit Works
The vulnerability lies in the improper validation of a user’s identity by the OTP-less one tap Sign in plugin for WordPress. This allows an unauthenticated attacker to change the email addresses of arbitrary users, including administrators, by sending a malicious request to the server. Once the email address is changed, the attacker can then initiate a password reset for the compromised account, effectively granting them access. Furthermore, the plugin returns authentication cookies in the response, which can be used by the attacker to directly access the account.
Conceptual Example Code
Below is a conceptual example of a malicious HTTP request that could potentially exploit this vulnerability:
POST /wp-admin/admin-ajax.php?action=otpl_otsi_update_email HTTP/1.1
Host: targetwebsite.com
Content-Type: application/x-www-form-urlencoded
user_id=1&new_email=attacker@evil.comIn this example, the `user_id` parameter is the ID of the user account to be attacked (with `1` commonly being the administrator’s account in WordPress), and the `new_email` parameter is the email address controlled by the attacker. If the request is successful, the targeted user’s email will be changed to the attacker’s email.